{
  "rule_ids": [
    "curl_pipe_shell"
  ],
  "severity": "HIGH",
  "command_redacted": "curl -s -X POST http://localhost:8191/v1 -H 'Content-Type: application/json' -d ...",
  "findings": [
    {
      "rule_id": "curl_pipe_shell",
      "severity": "HIGH",
      "title": "Pipe to interpreter: curl | python3",
      "description": "Command pipes output from 'curl' directly to interpreter 'python3'. Downloaded content will be executed without inspection.\n  Safer: tirith run http://localhost:8191/v1  — or: vet http://localhost:8191/v1  (https://getvet.sh)",
      "evidence": [
        {
          "type": "command_pattern",
          "pattern": "pipe to interpreter",
          "matched": "curl -s -X POST http://localhost:8191/v1 -H 'Content-Type: application/json' -d '{\"cmd\":\"request.get\",\"url\":\"https://www.apartments.com/boston-ma/\",\"maxTimeout\":30000}' 2>&1 | python3 -c \"\nimport sys, json, re\ndata = json.load(sys.stdin)\nsol = data.get('solution', {})\nprint(f'FlareSolverr apartments.com status: {sol.get(\\\"status\\\")}')\nresp = sol.get('response', '')\nif 'access denied' in resp.lower():\n    print('BLOCKED — FlareSolverr cannot bypass Apartments.com')\nelif 'captcha' in resp.lower():\n    print('BLOCKED — captcha still present')\nelse:\n    print(f'Response size: {len(resp)} chars')\n    count = len(re.findall(r'(?i)rental|apartment|bedroom|listing', resp[:10000]))\n    print(f'Content indicators: {count}')\n\" 2>&1"
        },
        {
          "type": "url",
          "raw": "http://localhost:8191/v1"
        }
      ],
      "mitre_id": "T1059.004"
    }
  ],
  "timestamp": "2026-07-06T23:30:26.324819913+00:00"
}