PRISM 2.7.0 — Domain Exposure & Security Fixes

A new exposure source, and three security fixes worth reading before you upgrade.

Domain Exposure (Lunar)

A second angle on compromised credentials, next to the Hudson Rock module. Where Hudson Rock gives you a snapshot of what is exposed right now, this one covers a rolling year: how often the domain turns up in infostealer logs and breach data month by month, split between your staff and your customers, plus which malware families were involved, which services were hit, and where from.

No API key. Aggregates only — the endpoint returns no credentials.

Off by default, like every module that talks to a third party:

LUNAR_ENABLED=true

Domain targets only, since the API covers no other type. Outbound requests honour MODULE_PROXY. Lunar builds a report on first request and caches it for a month, so the first scan of a domain nobody has looked up yet comes back as skipped with GENERATING_REPORT — scan it again once it's ready.

Thanks to @rangeva for proposing it in #286 and for putting the terms in writing.

Security

Rate limits could be bypassed with a header. The limiter keyed on X-Forwarded-For / X-Real-IP whatever TRUST_PROXY_HEADERS was set to. With no proxy in front — the default — a different header value per request meant a fresh bucket every time, so 10/minute on /api/scan and the 200/day and 60/hour ceilings did nothing. Each scan that bought fans out to dozens of third-party lookups. The headers are now read only when TRUST_PROXY_HEADERS is on, which is also when FORWARDED_ALLOW_IPS decides who may set them. Behaviour behind a configured proxy is unchanged, and the daily scan quota was never affected — it keys on the API-key principal.

A username could redirect a lookup to another host. Blackbird interpolated the username into its URL templates unescaped, and the Tumblr template carries the placeholder in the host position. Scanning evil.com/# built https://evil.com/#.tumblr.com/ and sent the request to evil.com. validate_target rejects only [;|`$<>{}], so a slash or a hash reached the module untouched. Usernames are percent-encoded now.

A username could write outside results/. Blackbird built its export filenames straight from the username, so ../../pwned escaped the output directory.

If you run an instance that is reachable from the internet, especially with ALLOW_ANON_API=1, upgrade.

Fixes

• JSON export failed on some usernames — user?name raised OSError before writing anything, a very long name raised FileNotFoundError. Same root cause as the export path issue above.
• A hanging maigret froze the scan — the wrapper read output to EOF and then called process.wait(), neither with a timeout, so a maigret that stopped producing output blocked its worker for good and the scan neither finished nor reported an error. A watchdog stops it after MAIGRET_MAX_RUNTIME seconds, 600 by default.
• A failed Blackbird search looked like a clean one — the API and CLI threw away what the module returned and read its result list, storing an empty list for a search that raised, which reads the same as checking every site and finding nothing.

Tests

249 → 285, covering the new module, the maigret watchdog, the rate-limit key, hostile usernames in export paths, and host escapes in the username URL templates.

---

Full notes in the CHANGELOG. If PRISM is useful to you, a ⭐ helps others find it.