INSTALLATION
RAGSTRIKE installs the specter-ragstrike CLI. Gate keys are loaded from environment variables. The signing key is generated on first run at ~/.red-specter/ragstrike/signing_key.pem. Session data and reports are stored in ~/.red-specter/ragstrike/.
GATE REQUIREMENTS
| Gate | Environment Variable | ROE Phrase | Additional Flags | Subsystems Unlocked |
|---|---|---|---|---|
| OPEN | None | None | None | ENUMERATE-RAG, FINGERPRINT-VECTOR-DB, REPORT, status, sessions |
| INJECT | RAGSTRIKE_INJECT_KEY | Required (any valid ROE file) | --roe <file> | EXPLOIT-CHROMADB, EXPLOIT-OTHER-VECTOR-DB, EXPLOIT-RAGFLOW, EXPLOIT-FRAMEWORK, POISON-EMBEDDINGS, CORRUPT-RETRIEVAL, AMPLIFY-HALLUCINATION |
| POISON | RAGSTRIKE_POISON_KEY | "rag ecosystem poisoning authorised" | --roe <file> --confirm-destroy | HARVEST-KNOWLEDGE, EXHAUST-CONTEXT |
| UNLEASHED | RAGSTRIKE_UNLEASHED_KEY | "rag unleashed authorised" | --roe <file> --confirm-destroy | PERSIST-RAG, CASCADE-RAG |
Gate keys are generated by the engagement controller and distributed per ROE. Keys are validated against an Ed25519 signature embedded in the ROE file. A key presented without a valid ROE is rejected at the gate check layer.
14 SUBSYSTEMS
01 — ENUMERATE-RAG [OPEN]
Network discovery sweep for vector database and RAG framework instances. Probes target CIDR ranges or individual hosts on default service ports: ChromaDB (8000), Qdrant REST (6333) and gRPC (6334), Milvus (19530), Weaviate (8080), pgvector/PostgreSQL (5432), LanceDB (configurable), Redis Vector (6379), RAGFlow (8080), Flowise (3000), AnythingLLM (3001), PrivateGPT (8001), Open WebUI (3000). Sends lightweight service identification probes. Returns an enumerated inventory with: endpoint URL, service type, version string (where detectable), authentication status (unauthenticated / API key / bearer / mTLS), collection count, and an attack surface score (0–100) based on the combination of authentication posture and version-specific known CVE surface.
02 — FINGERPRINT-VECTOR-DB [OPEN]
Deep profiling of a discovered vector database. Queries management APIs to extract: exact version string, all collection names with document counts, index algorithm (HNSW with ef_construction/M parameters / IVF with nlist / Flat), distance metric (cosine / L2 / inner product), embedding dimension (infers compatible embedding model), and estimated total vector count. Infers the upstream embedding model from dimension: 1536 = OpenAI text-embedding-3-small, 3072 = text-embedding-3-large, 1024 = Cohere embed-v3, 768 = typical sentence-transformers. Maps collection schemas to identify which contain the highest-value document corpora. Returns structured fingerprint report with recommended exploitation path per collection.
03 — EXPLOIT-CHROMADB [INJECT]
Comprehensive ChromaDB exploitation via unauthenticated REST API. Default ChromaDB deployments expose a full REST API on port 8000 with no authentication. EXPLOIT-CHROMADB implements five CVE exploits in sequence: (1) Collection enumeration — GET /api/v1/collections returns all collection names and IDs. (2) Full document dump — POST /api/v1/collections/{id}/query with a zero-vector and large n_results dumps all stored documents and metadata. (3) Arbitrary document injection — POST /api/v1/collections/{id}/add injects attacker-controlled documents with crafted embeddings into any collection. (4) Collection deletion — DELETE /api/v1/collections/{name} destroys target collections. (5) SSRF via custom embedding function — registers a malicious embedding function URL; ChromaDB calls back to the registered URL when computing embeddings, enabling SSRF to internal services reachable from the ChromaDB host. Requires RAGSTRIKE_INJECT_KEY and ROE file.
04 — EXPLOIT-OTHER-VECTOR-DB [INJECT]
Multi-target vector database exploitation for Qdrant, Milvus, Weaviate, pgvector, LanceDB, and Redis Vector. Qdrant: POST /collections/{name}/points/scroll with a large limit dumps all points and payloads without authentication on default installs; gRPC reflection attack identifies internal service topology. Milvus: gRPC reflection probe enumerates collections; Python SDK unauthenticated bulk insert. Weaviate: GraphQL introspection via POST /v1/graphql maps full object schema and cross-references; batch import via POST /v1/batch/objects. pgvector: SQL injection via LangChain PGVector integration — the similarity_search method passes the query vector as a string into a SQL template without parameterisation in vulnerable versions, enabling UNION-based data extraction. LanceDB: local path traversal reads arbitrary .lance database files. Redis Vector: keyspace scan (SCAN 0 MATCH * COUNT 1000) followed by HGETALL on each vector key dumps all stored vectors and metadata.
05 — EXPLOIT-RAGFLOW [INJECT]
Exploits CVE-2026-45312 (CVSS 9.9) in the RAGFlow document parsing API. RAGFlow's /api/document/parse endpoint accepts multipart file uploads and processes them using a subprocess call to a document parser binary. The filename parameter from the multipart form data is passed unsanitised into the subprocess invocation, enabling shell metacharacter injection. A crafted multipart request with a filename of ; $(command); executes arbitrary commands as the RAGFlow application user. RAGSTRIKE implements three exploit variants: (1) command output beacon — captures stdout and returns it in the API response, (2) reverse shell — opens a TCP reverse shell to operator-controlled listener, (3) file read — reads arbitrary files from the RAGFlow host filesystem. Tested against RAGFlow v0.14.1 through v0.18.2. Requires RAGSTRIKE_INJECT_KEY and ROE file with phrase "rag ecosystem poisoning authorised".
06 — EXPLOIT-FRAMEWORK [INJECT]
Framework-specific exploitation across eight major RAG frameworks. LlamaIndex: index store path traversal via unsanitised persist_dir in StorageContext.from_defaults() — reads arbitrary host filesystem paths. LangChain: arbitrary Python deserialisation via pickle.load() in vectorstore loading code paths accepting operator-controlled input; additionally exploits pgvector SQL injection. Haystack: YAML pipeline injection — Pipeline.load_from_yaml() instantiates arbitrary Python classes from a YAML file, enabling code execution. Flowise: unauthenticated GET /api/v1/credentials endpoint returns all stored API keys, database passwords, and OAuth tokens in plaintext on default installs. AnythingLLM: admin REST API accessible to unauthenticated users on default configuration — reads system settings, user accounts, workspace documents, and system prompt. PrivateGPT: SSRF via llm_mode=custom and custom_openai_base_url configuration parameter, redirecting LLM inference calls to internal services. Open WebUI: stored XSS via unsanitised chat conversation title renders in admin UI, exfiltrating localStorage token to attacker-controlled endpoint.
07 — POISON-EMBEDDINGS [INJECT]
Two-phase embedding attack implementing Vec2Text inversion and FGSM adversarial injection. Phase 1 — Vec2Text Inversion (arXiv:2310.16832): given raw embedding vectors extracted from the target vector store, applies an iterative gradient-based text reconstruction algorithm to recover the original document text. The reconstructed corpus is stored locally for knowledge base intelligence. Phase 2 — FGSM Adversarial Injection: for each operator-defined target query class, computes the gradient of the cosine similarity loss between a seed document embedding and the target query class centroid. Applies a perturbation of epsilon=0.08 in the gradient direction, producing an adversarial embedding that is the nearest-neighbour match for the target query class while containing the operator-supplied false content. Injects adversarial documents with these crafted embeddings into the target collection. Subsequent queries matching the target class retrieve the adversarial document with high cosine similarity, displacing legitimate content.
08 — CORRUPT-RETRIEVAL [INJECT]
Retrieval ranking corruption through high-similarity document injection. Constructs adversarial documents with embedding vectors engineered to have cosine similarity >0.95 with the target query embedding, ensuring they appear in every top-k retrieval result for the target query class. Implements semantic collision attack: measures the average embedding centroid of historical queries in the target class (estimated from collection content analysis), then generates document embeddings that maximally overlap this centroid while containing attacker-controlled content. Supports all three distance metrics: cosine, L2, and inner product. Reports retrieval corruption rate as the fraction of top-k retrieval slots captured by adversarial content across a 100-probe test battery.
09 — HARVEST-KNOWLEDGE [POISON]
Complete proprietary knowledge base extraction. Dumps the full content of all accessible collections in the target vector store, including document text, metadata fields, and raw embedding vectors. Where document text is not stored in metadata (embeddings-only mode), applies Vec2Text reconstruction to recover the original text from the vector representation. Reconstructs the complete document corpus in a structured format, organised by collection and estimated topic cluster (using k-means on the embedding space). Embeds a cryptographic watermark in the extracted corpus — a subtle statistical pattern in the word frequency distribution — enabling provenance confirmation if the stolen knowledge base is later observed in adversary systems. Requires RAGSTRIKE_POISON_KEY, ROE phrase "rag ecosystem poisoning authorised", and --confirm-destroy.
10 — AMPLIFY-HALLUCINATION [INJECT]
Statistical hallucination amplification by false document flooding. Accepts an operator-supplied false claim table specifying fabricated facts per target domain (medical, financial, legal, technical). Generates a large volume of plausible-sounding documents embedding the false claims, with embeddings optimised for high cosine similarity to target query classes. Injects sufficient volume to achieve statistical dominance: >50% of top-k retrieval slots for target queries return documents containing false claims. Runs a pre- and post-injection hallucination measurement using a probe query battery against a connected LLM: the LLM is queried on target topics before and after injection, and output accuracy is assessed against the ground-truth fact table. Reports hallucination rate delta (pre-injection accuracy minus post-injection accuracy).
11 — EXHAUST-CONTEXT [POISON]
Context window denial-of-service and token cost amplification. Injects artificially oversized documents that fill the target LLM's entire context window when retrieved. Computes optimal document length for context exhaustion given the target model's context limit (configurable; detected from model metadata where available). When these documents are retrieved, the LLM context is completely consumed by the adversarial document, leaving zero tokens for the user query or system prompt. Supports token cost amplification variant: each query to the RAG system now incurs maximum context tokens, dramatically increasing per-query API cost. Reports queries-per-minute capacity impact and estimated cost amplification factor. Requires RAGSTRIKE_POISON_KEY, ROE phrase, and --confirm-destroy.
12 — PERSIST-RAG [UNLEASHED]
Establishes persistent adversarial backdoor in the vector store that survives full re-indexing. Plants adversarial documents with metadata including a trigger-phrase detector — the document is crafted to be the nearest-neighbour match for any query containing the operator-defined trigger phrase, regardless of query topic. The trigger-phrase embedding is computed by averaging embeddings of multiple paraphrases of the trigger phrase, ensuring robustness to trigger phrasing variation. Additionally seeds persistence into upstream document ingestion pipelines: S3 buckets, SharePoint document libraries, and Git repositories monitored by the RAG ingest daemon are seeded with adversarial documents that re-poison the vector store on each re-indexing run. Requires RAGSTRIKE_UNLEASHED_KEY, ROE phrase "rag unleashed authorised", and --confirm-destroy.
13 — CASCADE-RAG [UNLEASHED]
Cross-pipeline propagation of poisoned embeddings across connected RAG deployments. Maps downstream consumers of the target vector store by: (1) enumerating API keys with read access to multiple collections (suggesting shared infrastructure), (2) identifying namespace patterns indicating multi-tenant deployments on the same vector store, (3) tracing downstream agent pipelines via LangChain/LlamaIndex configuration files that reference the target vector store endpoint. Propagates adversarial content to each identified connected pipeline's collection. In misconfigured multi-tenant deployments, adversarial documents injected without tenant-scoped namespace isolation cross-contaminate other tenants' retrieval results. Reports cascade depth (number of downstream consumers reached) and total blast radius (number of unique RAG pipelines affected). Requires RAGSTRIKE_UNLEASHED_KEY, ROE phrase "rag unleashed authorised", and --confirm-destroy.
14 — REPORT [OPEN]
Generates the final RGS-{hex12} session report. Aggregates all subsystem results into a structured canonical JSON document. Cryptographically signs with Ed25519 (private key at ~/.red-specter/ragstrike/signing_key.pem) and countersigns with ML-DSA-65 (NIST FIPS 204 post-quantum signature). Saves signed report to ~/.red-specter/ragstrike/reports/RGS-{hex12}.json.
8 VECTOR STORES — EXPLOITATION MATRIX
| Vector Store | Default Port | Auth (Default) | Primary Attack | Gate |
|---|---|---|---|---|
| ChromaDB | 8000 | None | REST API dump, document injection, SSRF via embedding fn | INJECT |
| Qdrant | 6333 (REST) / 6334 (gRPC) | None (default) | /collections/{name}/points/scroll dump; gRPC reflection | INJECT |
| Milvus | 19530 | None (default) | gRPC reflection; SDK unauthenticated insert | INJECT |
| Weaviate | 8080 | None (default) | GraphQL introspection; batch import via /v1/batch/objects | INJECT |
| Pinecone | API (cloud) | API key (stolen) | Namespace enumeration; vector fetch; metadata filter bypass | INJECT |
| pgvector | 5432 | PostgreSQL auth | SQL injection via LangChain PGVector similarity_search | INJECT |
| LanceDB | local / configurable | None (local) | Path traversal to read .lance database files | INJECT |
| Redis Vector | 6379 | None (default) | SCAN keyspace; HGETALL vector data; FT.SEARCH query | INJECT |
8 RAG FRAMEWORKS — EXPLOITATION MATRIX
| Framework | Default Port | Primary Vulnerability | Impact | Gate |
|---|---|---|---|---|
| RAGFlow | 8080 | CVE-2026-45312 CVSS 9.9 — subprocess injection via /api/document/parse filename | RCE as application user | INJECT |
| LlamaIndex | varies | Path traversal via unsanitised persist_dir in StorageContext.from_defaults() | Arbitrary file read | INJECT |
| LangChain | varies | Pickle deserialisation + pgvector SQL injection in similarity_search | RCE / DB dump | INJECT |
| Haystack | varies | YAML pipeline injection — arbitrary Python class instantiation via Pipeline.load_from_yaml() | RCE on pipeline load | INJECT |
| Flowise | 3000 | Unauthenticated GET /api/v1/credentials — all stored secrets returned in plaintext | Credential harvest | INJECT |
| AnythingLLM | 3001 | Admin API accessible without auth on default install | Full system control | INJECT |
| PrivateGPT | 8001 | SSRF via custom_openai_base_url configuration parameter | Internal network SSRF | INJECT |
| Open WebUI | 3000 | Stored XSS in chat title → localStorage token exfil | Session hijack | INJECT |
KEY CVEs
/api/document/parse REST endpoint accepts multipart file uploads and constructs a shell subprocess invocation using the filename field from the Content-Disposition header without sanitisation. An attacker submitting a multipart POST request with a filename containing shell metacharacters (e.g., ; whoami ;) achieves arbitrary command execution as the user running the RAGFlow process. No authentication is required on default RAGFlow deployments. The executed command's stdout is returned in the API response. CVSS Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Patch: RAGFlow v0.19.0 (validate and sanitise filename parameter, use subprocess list form to avoid shell injection).RESEARCH CITATIONS
Vec2Text (arXiv:2310.16832) — Morris et al., "Text Embeddings Reveal (Almost) As Much As Text", EMNLP 2023. Demonstrates that text embeddings produced by large embedding models can be inverted to reconstruct the original text with high fidelity using an iterative gradient-based reconstruction algorithm. SPECTER RAGSTRIKE implements the Vec2Text attack to recover proprietary knowledge base content from stolen embedding vectors.
FGSM in Embedding Space — Adaptation of Goodfellow et al. Fast Gradient Sign Method applied to the embedding space rather than the input space. Perturbs a document embedding in the gradient direction of the cosine similarity loss function, producing adversarial embeddings that are nearest-neighbour matches for target query classes while containing attacker-controlled content.
FULL CLI REFERENCE
OPEN GATE — No key required
INJECT GATE — RAGSTRIKE_INJECT_KEY required
POISON GATE — RAGSTRIKE_POISON_KEY + ROE phrase + --confirm-destroy
UNLEASHED GATE — RAGSTRIKE_UNLEASHED_KEY + ROE phrase + --confirm-destroy
REPORT FORMAT — RGS-{hex12}
All sessions produce an RGS-{hex12} signed canonical JSON report. The hex12 component is a cryptographically random 12-byte hex string unique to each session. Reports are saved to ~/.red-specter/ragstrike/reports/RGS-{hex12}.json.
WMD CLASSES
WMD classes are used by NIGHTFALL CAMPAIGN GRAPH to categorise findings, by WARLORD for multi-tool engagement coordination, and by the ARMORY for payload selection. Each class maps to a set of ARMORY payload categories and a defensive monitoring posture in AI Shield.