Detect exposed Jupyter servers and vector databases, and an AEM reflected XSS

More read only checks, aimed at the places attackers using AI tools go.

An open Jupyter server answers its authenticated API with no token, which means
anyone who reaches it can run code and read files on the host: arbitrary code
execution.  The check confirms it by the contents, kernel specs or session API
answering without a login, against a control.

A vector database left without authentication, which is how Chroma, Qdrant and
Weaviate ship by default, exposes the embeddings that encode the organization's
documents, to read and to poison.  The check confirms each by a string it
returns.

Adobe AEM: the ContentFinder suggestions endpoint echoing a parameter back
unencoded, which is a reflected cross site scripting sink, confirmed when a
harmless marker comes back unencoded.

The real world precedent table gained the vector store exposure class, and the
AI tool class now covers notebook servers.

Author: hackrange

app/core/dast_checks/curated/injection-aem-contentfinder-xss.json

@@ -0,0 +1,25 @@
+{
+  "id": "injection-aem-contentfinder-xss",
+  "class": "injection",
+  "safety": "read",
+  "severity_floor": "medium",
+  "title": "Adobe AEM reflects a script payload (ContentFinder XSS)",
+  "summary": "The AEM ContentFinder suggestions endpoint echoes a query parameter into its response without encoding it, so a crafted link runs script in the visitor's session. The check sends a harmless marker and confirms it comes back unencoded.",
+  "needs": [],
+  "candidate_paths": [
+    "/bin/wcm/contentfinder/connector/suggestions.json?query_term=path%3a/&pre=%3Csvg/onload%3Dalert(1)%3E&post=x"
+  ],
+  "probe": [
+    { "request": { "method": "GET", "path": "{route}" } }
+  ],
+  "confirm": {
+    "control": "A path that cannot exist, so the site's not found answer is known and a page that reflects the marker is told apart from it.",
+    "differential": "status == 200 and body_contains(\"<svg/onload=alert(1)>\") and body_differs(control)",
+    "retest": 2
+  },
+  "reproduce": "curl -sk 'https://host/bin/wcm/contentfinder/connector/suggestions.json?query_term=path:/&pre=%3Csvg/onload=alert(1)%3E&post=x' and check the response echoes <svg/onload=alert(1)> unencoded. Unencoded reflection means the parameter is a cross site scripting sink.",
+  "remediate": "Patch AEM and block the ContentFinder endpoints at the dispatcher if they are not needed. Output encode any reflected value. Follow Adobe's AEM dispatcher security checklist.",
+  "references": [],
+  "mappings": { "cwe": "CWE-79", "owasp": "A03:2021" },
+  "rulesets": ["aem"]
+}

app/core/dast_checks/curated/misconfiguration-jupyter-exposed.json

@@ -0,0 +1,28 @@
+{
+  "id": "misconfiguration-jupyter-exposed",
+  "class": "misconfiguration",
+  "safety": "read",
+  "severity_floor": "high",
+  "title": "Jupyter notebook server is exposed without a token",
+  "summary": "A Jupyter server is answering its authenticated API without a token or password, so anyone who can reach it can open a notebook, run code and read files on the host.  An open Jupyter server is arbitrary code execution on the machine it runs on.",
+  "needs": [],
+  "candidate_paths": [
+    "/api/contents",
+    "/api/contents/",
+    "/api/kernelspecs",
+    "/api/sessions"
+  ],
+  "probe": [
+    { "request": { "method": "GET", "path": "{route}" } }
+  ],
+  "confirm": {
+    "control": "A path that cannot exist, so the site's not found answer is known and an open API response is told apart from a soft 404.",
+    "differential": "status == 200 and (body_contains(\"\\\"kernelspecs\\\"\") or (body_contains(\"\\\"type\\\":\\\"directory\\\"\") and body_contains(\"\\\"writable\\\"\")) or body_contains(\"\\\"execution_state\\\"\")) and body_differs(control)",
+    "retest": 2
+  },
+  "reproduce": "curl -sk 'https://host/api/contents' (or /api/kernelspecs) with no token.  A token protected server answers 403; an open one answers 200 with the contents listing (type directory, writable) or the kernel specs.  Either means the server runs code for anyone who can reach it.",
+  "remediate": "Set a strong token or password, bind the server to localhost or a trusted range (c.NotebookApp.ip and c.NotebookApp.token), and firewall it off the internet.  Never run a notebook server open to the network.",
+  "references": [],
+  "mappings": { "cwe": "CWE-306", "owasp": "A05:2021" },
+  "rulesets": ["jupyter"]
+}

app/core/dast_checks/curated/misconfiguration-vector-db-exposed.json

@@ -0,0 +1,28 @@
+{
+  "id": "misconfiguration-vector-db-exposed",
+  "class": "misconfiguration",
+  "safety": "read",
+  "severity_floor": "high",
+  "title": "A vector database is exposed without authentication",
+  "summary": "A vector database (Chroma, Qdrant or Weaviate) is answering without a login. These stores hold the embeddings that encode the organization's documents, so an outsider who reaches it can read the whole knowledge base and write poisoned vectors that steer the AI's answers. The major vector databases ship with no authentication by default.",
+  "needs": [],
+  "candidate_paths": [
+    "/api/v1/heartbeat",
+    "/api/v2/heartbeat",
+    "/collections",
+    "/v1/meta"
+  ],
+  "probe": [
+    { "request": { "method": "GET", "path": "{route}" } }
+  ],
+  "confirm": {
+    "control": "A path that cannot exist, so the site's not found answer is known and the database response is told apart from a soft 404.",
+    "differential": "status == 200 and (body_contains(\"nanosecond heartbeat\") or (body_contains(\"\\\"status\\\":\\\"ok\\\"\") and body_contains(\"\\\"collections\\\"\")) or (body_contains(\"\\\"hostname\\\"\") and body_contains(\"\\\"modules\\\"\"))) and body_differs(control)",
+    "retest": 2
+  },
+  "reproduce": "curl -sk 'https://host/api/v1/heartbeat' (Chroma answers with a nanosecond heartbeat), 'https://host/collections' (Qdrant answers status ok with its collections), or 'https://host/v1/meta' (Weaviate answers with its hostname and modules). If any answers without a login, the vector store is open to anyone.",
+  "remediate": "Turn on authentication (an API key for Qdrant, Chroma's token auth, Weaviate's API key or OIDC), bind the database to localhost or a trusted range, and firewall its port off the internet. Treat the embedded corpus as readable and poisonable until it is closed.",
+  "references": [],
+  "mappings": { "cwe": "CWE-306", "owasp": "A05:2021" },
+  "rulesets": ["vector-db"]
+}

app/core/dast_precedent.py

@@ -173,10 +173,26 @@
                      "QueryBuilder and default GET servlet endpoints, and Adobe has issued "
                      "critical AEM patches.",
     },
+    {
+        "key": "vector-db-exposure",
+        "match": re.compile(r"vector (data)?base|chromadb|\bchroma\b|qdrant|weaviate|"
+                            r"embeddings|nanosecond heartbeat", re.I),
+        "ref": "CWE-306; OWASP A05:2021",
+        "abuse": "An attacker reads the stored embeddings, which encode the "
+                 "organization's documents, exfiltrating the knowledge base, and "
+                 "writes poisoned vectors so the AI built on it returns attacker "
+                 "chosen content.",
+        "precedent": "Unauthenticated Chroma, Qdrant and Weaviate instances are "
+                     "routinely found exposed on the internet; the major vector "
+                     "stores default to no authentication, so the embedded corpus "
+                     "and the retrieval answers built on it are open to read and "
+                     "to poison.",
+    },
     {
         "key": "ai-tool-exposure",
         "match": re.compile(r"open (self-)?registration|registrationenabled|librechat|"
-                            r"ollama|open webui|llmjack|exposed ai|model api key", re.I),
+                            r"ollama|open webui|llmjack|exposed ai|model api key|"
+                            r"jupyter|notebook server", re.I),
         "ref": "CWE-1188; LLMjacking (Sysdig, 2024)",
         "abuse": "An attacker reaches the exposed AI tool, creates an account or uses an "
                  "open endpoint, and runs their own work on the organization's paid model "