Giter VIP home page Giter VIP logo

gocvss's Introduction

Build Status GoDoc

gocvss

Library to parse Common Vulnerability Scoring System vectors and generate scores

Usage

Let's take CVE-2002-0392 as an example, suppose you already have a base vector, you can parse it with

var c, err = Parse("AV:N/AC:L/Au:N/C:N/I:N/A:C")
if err != nil {
		t.Errorf("New from vector failed: %v", err)
}

And then add the different vectors based on your environment:

// Temporal vectors
c = append(c, Exploitability_Functional)
c = append(c, RemediationLevel_OfficialFix)
c = append(c, ReportConfidence_Confirmed)
// Environmental vectors
c = append(c, CollateralDamagePotential_High)
c = append(c, TargetDistribution_High)
c = append(c, ConfidentialityRequirement_High)
c = append(c, IntegrityRequirement_High)
c = append(c, AvailabilityRequirement_High)

Then compute the scores and/or display them:

s := c.Score()
//-> Score{7.8, 6.4, 9.2}

fmt.Print(c.String())
        base score                     7.800000
          access vector                1.000000
          access complexity            0.710000
          authentication               0.704000
          confidentiality impact       0.000000
          integrity impact             0.000000
          availability impact          0.660000

        temporal score                 6.400000
          exploitability               0.950000
          remediation level            0.870000
          report confidence            1.000000

        environmental score            9.200000
          collateral damage potential  0.500000
          target distribution          1.000000
          confidentiality requirement  1.000000
          integrity requirement        1.510000
          availability requirement     1.510000

gocvss's People

Contributors

attwad avatar

Stargazers

Daren Darrow avatar avatar avatar derez avatar JT5D avatar

Watchers

James Cloos avatar avatar avatar

Forkers

imclab pombredanne

gocvss's Issues

Invalid CVSS v2 vector output

During differential fuzzing with github.com/pandatix/go-cvss, I discovered that your implementation emits CVSS v2 vectors that are invalid.

Indeed, you are outputing the CVSS v2 vector in ascendent order of metrics.
Nevertheless, the first.org specification states at Section 2.4 that a vector has a "predetermined order", documented in Table 13.

In order to be compliant, you must output metrics in the specified order.

The following Go code illustrates this issue.

package main

import (
	"fmt"
	"log"

	cvss "github.com/attwad/gocvss"
)

func main() {
	raw := "AV:N/AC:L/Au:N/C:N/I:N/A:C/E:F/RL:OF/RC:C"
	vec, err := cvss.Parse(raw)
	if err != nil {
		log.Fatal(err)
	}

	out := vec.ToStringVector()
	fmt.Printf("out: %v\n", out)
}

produces ->

out: A:C/AC:L/AV:N/Au:N/C:N/E:F/I:N/RC:C/RL:OF

Improper Input Validation in CVSS v2 parsing

During differential fuzzing with github.com/pandatix/go-cvss, I discovered that your implementation does not validate inputs properly.
When providing the E:U metric in a vector, an error is raised. Nevertheless, the first.org specification Table 13 shows the E (Exploitability) metric can be U (Unproven).

In order to be compliant with the specification, you must review your validation process to validate E:U (probably mistyped with E:P after a quick code review).

The following Go code illustrates this issue.

package main

import (
	"fmt"

	cvss "github.com/attwad/gocvss"
)

func main() {
	raw := "AV:N/AC:L/Au:N/C:P/I:P/A:C/E:U/RL:OF/RC:C"
	vec, err := cvss.Parse(raw)

	fmt.Printf("vec: %v\n", vec)
	fmt.Printf("err: %v\n", err)
}

produces ->

vec: base score                     0.000000
  access vector                0.000000
  access complexity            0.000000
  authentication               0.000000
  confidentiality impact       0.000000
  integrity impact             0.000000
  availability impact          0.000000

temporal score                 0.000000
  exploitability               1.000000
  remediation level            1.000000
  report confidence            1.000000

environmental score            0.000000
  collateral damage potential  0.000000
  target distribution          0.000000
  confidentiality requirement  1.000000
  integrity requirement        1.000000
  availability requirement     1.000000

err: cvss: unrecognized metric "E:U"

Invalid CVSS v2 environmental score computation

During differential fuzzing with github.com/pandatix/go-cvss I discovered that your implementation does not properly computes the environmental score, and more precisely returns 0 when no environmental variable is set different to ND (Not Defined).

In order to be compliant with the first.org specification Section 3.2.3, you must compute the environmental score given your metric values.

The following Go code illustrates this issue.

package main

import (
	"fmt"
	"log"

	cvss "github.com/attwad/gocvss"
)

func main() {
	raw := "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C"
	vec, err := cvss.Parse(raw)
	if err != nil {
		log.Fatal(err)
	}

	s := vec.Score()
	b, t, e := s.Base, s.Temporal, s.Environmental
	fmt.Printf("Scores: %.1f;%.1f;%.1f\n", b, t, e)
}

produces ->

Scores: 10.0;8.3;0.0

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.