summit v0.6.0 - command injection, SSTI, CRLF, sensitive files, CWE/CVE tagging

Sixth release. Four new check families and - the headline - every finding in every report now carries its CWE (and CVE where a version banner matches the offline database).

New in v0.6.0

OS command injection (CWE-78)

Echo-based probes across seven shell separators, with an anti-false-positive control probe: the exec marker must appear MORE often than the control marker. A server that merely reflects input shows both markers equally and is suppressed. Measured on the demo: exec x2 vs control x1 -> confirmed. No time-based sleep payloads, ever.

Server-side template injection (CWE-1336, RCE class)

{{7*7}}, ${7*7}, <%= 7*7 %>, {7*7} - confirmed only when 49 comes back and is absent from the baseline. Measured: Jinja2 canary -> 49, confirmed.

CRLF injection (CWE-113)

An injected header must materialize in the response. Measured: X-Summit-CRLF: injected, confirmed.

Sensitive file exposure (CWE-538)

.env, .git/config, database dumps, config backups - confirmed by content signature, never by status code alone (wildcard-routing servers make status-code checks useless). Runs once per scan against the origin.

CWE/CVE tagging

Every finding now carries its CWE (central map, 30+ check ids) and version banners are matched against an offline curated CVE database (Apache 2.4.49/50, nginx 1.20.0, OpenSSH 7.2, PHP 7.4.0, Tomcat 9). CVE findings stay potential - banners are trivially spoofed. Console, JSON and HTML reports all include the references.

Verified

• 60 tests, ruff clean
• evidence runner: 19/19 claims (16 seeded check families, zero false positives, each new check shown with its own evidence)
• demo app grew to sixteen seeded issue classes

Install

git clone https://github.com/pennacle-security/summit.git && cd summit && pip install -e .

Python 3.10+, requests is the only dependency.

Authorized testing only.