Exploit for vulnerability-harness

## https://sploitus.com/exploit?id=06C09C28-FBF2-5688-B8B3-6A4A76AFA09B
# Vulnerability Harness

> An LLM harness that **reads code, forms hypotheses, writes a PoC, and executes it in a Docker sandbox** — then ships only the bugs it could actually trigger.

[**한국어 README**](README.ko.md)  ·  Apache-2.0  ·  Python 3.11+

---

**No preview model, no early access required.** A file-level
*hunter → reviewer* scaffold that runs on an ordinary, publicly available
frontier model.

It still produces findings that survive third-party review — see
[Externally validated findings](#externally-validated-findings).

---

## How the harness works


  


For every top-ranked file the harness runs a set of independent hunter
sessions — fresh context, no shared history. Each hunter carries a
**different vulnerability lens** (injection, SSRF, deserialization,
access-control, path-traversal, …), so one file is examined from several
angles at once. A separate **Reviewer** re-runs each finding's PoC and may
drop a group entirely if it doesn't reproduce — the diversity of
independent runs is the point.

```
Filter → Rank → Selector → Sandbox Prepare → Hunt (Hunter → Cluster → Review) → Report
```

1. **Filter** — drop tests, vendored, generated code (no LLM).
2. **Rank** — score every source file 1–5 for security relevance.
3. **Selector** — pick which files Hunters will run on.
4. **Sandbox Prepare** — build a per-repo Docker image (deterministic
   install per environment: pip / go). Or use a custom image you've built.
5. **Hunt** — one independent session per (file, hunter). Reads, greps,
   writes a PoC into `/workspace`, executes it in a network-isolated
   container. `network: none`, `/code` read-only, `/workspace` tmpfs.
6. **Cluster** — group near-duplicate findings within a file.
7. **Review** — verdict + CVSS + writeup.
8. **Report** — JSON + Markdown.

---

## Externally validated findings

CVEs assigned to findings produced by single runs of this harness — each
reproduced with an executed PoC before disclosure.

The striking part: every CVE below came from hunting only the **top ≤30
files** — a thin slice of each codebase (well under 1% on the large projects,
a few percent on the small ones). None of these was a full scan; this is what
a sample already turns up.

| CVE | CVSS | Target | Language | Class |
|-----|:----:|--------|----------|-------|
| [CVE-2026-15307](https://vulners.com/cve/CVE-2026-15307) | 8.8 | Django | Python | SSRF / file-write → RCE |
| [CVE-2026-44843](https://vulners.com/cve/CVE-2026-44843) | 8.2 | LangChain | Python | Deserialization |
| [CVE-2026-56091](https://vulners.com/cve/CVE-2026-56091) | 8.2 | Apache Shiro | Java | Auth bypass |
| [CVE-2026-57580](https://vulners.com/cve/CVE-2026-57580) | 9.4 | Authentik | Python | Account takeover |
| [CVE-2026-59242](https://vulners.com/cve/CVE-2026-59242) | 5.4 | Apache Airflow | Python | Deserialization |
| [CVE-2026-16105](https://vulners.com/cve/CVE-2026-16105) | 4.9 | Keycloak | Java | Broken access control |

More findings on additional Go and C targets are pending advisory.

---

## Quick start

> **Requirements:** Python 3.11+, Docker, AWS credentials with Bedrock
> access to a frontier model (this run used Sonnet 5.0).

```bash
# 1. install
git clone https://github.com/ksgsslee/vulnerability-harness.git
cd vulnerability-harness
pip install -e .

# 2. config — copy the template, edit provider/region/keys
cp settings.example.toml settings.toml

# 3. credentials (Bedrock direct: SSO/role/AWS_PROFILE all work)
aws sso login

# 4. run the UI
streamlit run src/vulnhunt_agent/app.py
```

In the sidebar: pick a repo (git URL or local path), pick an
**Environment** (e.g. `python:3.12`, `go:1.24`), click **Save**,
then run each step from top to bottom.

**Troubleshooting** — if Bedrock returns `AccessDeniedException`, enable
model access for your chosen model in the Bedrock console. The model and
provider catalog lives in [settings.toml](settings.example.toml).


  


When a run finishes, the Final Report ranks every grouped finding by
CVSS; each row expands into a writeup with a Reviewer summary, the CWE /
CVSS vector, and the PoC that reproduced in the sandbox.

---

## Configuration

Two locations at the repo root, both edited by the operator:

**[settings.toml](settings.example.toml)** (gitignored) — copy from
`settings.example.toml`. Holds the **`[[providers]]`** list (Bedrock
direct, bedrock-mantle, LiteLLM, in-house OpenAI-compatible proxies)
and the **`[[models]]`** catalog. Each model points at one provider.
Swap the hunter / reviewer / ranker model independently from the sidebar.

**[prompts/](prompts/)** — every prompt lives here:
- `prompts/hunters/python.md` — broad, language-wide review prompt.
- `prompts/hunters/python/*.md` — focused hunters, one per vulnerability
  class (injection, ssrf, deserialization, access_control,
  path_traversal). Drop a new `.md` in here to add a lens. When a
  language has focused hunters, they run *instead of* the broad prompt.
- `prompts/rankers/.md` — per-language ranker hint.

That's it — no `.env`, no `~/.scanner/`, no scattered config.

---

## License

[Apache-2.0](LICENSE)