Skip to content

Commit 818d938

Browse files
martindgmartindg
committed
CVSS intro
1 parent 4b82268 commit 818d938

3 files changed

Lines changed: 314 additions & 17 deletions

File tree

‎trainingportal/static/lessons/cvss/cvss_intro.md‎

Lines changed: 303 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,305 @@
1-
#### Agreeing on vulnerability severity
1+
## The Common Vulnerability Scoring System (CVSS)
22

3-
The Common Vulnerability Scoring System (CVSS) is how we agree on vulnerability severity.
3+
<br>
44

5-
We need to agree on severity so we may prioritize investing our time and effort where it matters most.
5+
The Common Vulnerability Scoring System (CVSS) is an *open framework for communicating the characteristics and severity of software vulnerabilities*. You can find the most complete and up-to-date information on CVSS at [https://www.first.org/cvss/](https://www.first.org/cvss/). The current version of the CVSS specification is CVSS v4 with CVSS v3 still being widely used. CVSS provides a standardized vendor agnostic and platform agnostic methodology and produces a CVSS Score value between 0 and 10 and a CVSS rating:
6+
7+
- 9.0 - 10.0 Critical
8+
- 7.0 - 8.9 High
9+
- 4.0 - 6.9 Medium
10+
- 0.1 - 3.9 Low
11+
- 0.0 None
12+
13+
14+
15+
The CVSS score is produced by choosing the corresponding values for each CVSS metric (metrics will be covered in detail later in this chapter). The final set of all metrics is represented in the so called CVSS Vector e.g. `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`. This example is decoded as:
16+
17+
- `AV:N` -> Attack Vector (AV): Network (N)
18+
- `AC:L` -> Attack Complexity (AC): Low (L)
19+
- `AT:N` -> Attack Requirements (AT): None (N)
20+
- `PR:N` -> Privileges Required (PR): None (N)
21+
- `UI:N` -> User Interaction (UI): None (N)
22+
- `VC:H` -> Vulnerable System Confidentiality (VC): High (H)
23+
- `VI:H` -> Vulnerable System Integrity (VI): High (H)
24+
- `VA:N` -> Vulnerable System Availability (VA): None (N)
25+
- `SC:N` -> Subsequent System Confidentiality (SC): None (N)
26+
- `SI:N` -> Subsequent System Integrity (SI): None (N)
27+
- `SA:N` -> Subsequent System Availability (SA): None (N)
28+
29+
Just by looking at the CVSS Vector, we can understand the (high-level) story behind the vulnerability. In this example we can see that: An unauthenticated attacker (`AV:N/AC:L/AT:N/PR:N/UI:N`) can read and write sensitive data (`VC:H/VI:H/VA:N`).
30+
31+
<br><br><br>
32+
33+
---
34+
35+
### It is important to note that CVSS `is not a` *Risk Score*.
36+
37+
<br><br>
38+
39+
CVSS gives us a **technical score** of a vulnerability. It does **NOT** deal with any business, financial, health or any other form of risk. To better understand this, consider the following example:
40+
41+
- 2 different vulnerabilities
42+
- The same CVSS score of 9.0 Critical
43+
- One of those is in a music player / sound device
44+
- The other is in a medical software responsible for delivering health-critical medical services to patients
45+
46+
The CVSS specification explicitly covers that vulnerability management should consider factors that are outside of CVSS:
47+
48+
Consumers may use CVSS information as input to an organizational vulnerability management
49+
process that also considers factors that are not part of CVSS in order to rank the threats
50+
to their technology infrastructure and make informed remediation decisions. Such factors may
51+
include, but are not limited to: regulatory requirements, number of customers impacted,
52+
monetary losses due to a breach, life or property threatened, or reputational impacts of a
53+
potential exploited vulnerability. These factors are outside the scope of CVSS.
54+
55+
---
56+
57+
<br><br><br>
58+
59+
## CVSS Metric Groups
60+
61+
<br>
62+
63+
CVSS v4 has 4 metric groups:
64+
65+
- Base.
66+
- Intrinsic characteristics
67+
- Constant over time
68+
- Assumes reasonable worst-case impact
69+
- Threat.
70+
- The current state of exploitability and remediation
71+
- Can only go lower than the Base score
72+
- Environmental.
73+
- Adjusted to specific environment
74+
- Considers mitigating factors
75+
- Considers adverse effects
76+
- Can go higher or lower than the Base score
77+
- Supplemental.
78+
- Context and additional extrinsic attributes
79+
- No impact on the CVSS score
80+
81+
For the remainder of this chapter, we will be focusing only on the Base metric group as it provides the most robust measure of a vulnerability's characteristics. The Environmental group is also very effective for adjusting the exploitability and impact metrics for a particular environment and can be viewed as a modification to the Base metric.
82+
83+
84+
## CVSS Base Score
85+
86+
CVSS Base metrics go into 2 broad categories:
87+
88+
- **Exploitability**. How easy/hard it is to exploit the vulnerability and what the prerequisites are.
89+
- `Attack Vector (AV)`
90+
- `Attack Complexity (AC)`
91+
- `Attack Requirements (AT)`
92+
- `Privileges Required (PR)`
93+
- `User Interaction (UI)`
94+
- **Impact**. The security properties being violated.
95+
- *Vulnerable System*. The system that has the vulnerability.
96+
- `Confidentialiy (VC)`
97+
- `Integrity (VI)`
98+
- `Availability (VA)`
99+
- *Subsequent System*. Other dependent system(s) being impacted.
100+
- `Confidentiality (SC)`
101+
- `Integrity (SI)`
102+
- `Availability (SA)`
103+
104+
<br><br><br>
105+
106+
### Exploitability Metrics
107+
108+
#### [Attack Vector (AV)](https://www.first.org/cvss/v4-0/specification-document#Attack-Vector-AV)
109+
- **Question**: From where can an attacker execute the attack?
110+
- **Values**:
111+
- Network (`N`)
112+
- Remotely over the network
113+
- **Examples**:
114+
- Web-based attacks
115+
- Adjacent (`A`)
116+
- Local/Adjacent network (physical or logical)
117+
- **Examples**:
118+
- Physical proximity
119+
- Bluetooth
120+
- WiFi
121+
- Logical proximity
122+
- ARP
123+
- DHCP
124+
- Local (`L`)
125+
- Not bound to the network stack
126+
- **Examples**:
127+
- Vulnerable lock screen
128+
- Malware infected document
129+
- Local Privilege Escalation (LPE)
130+
- Physical (`P`)
131+
- Physical access to the device
132+
- **Examples**:
133+
- Malicious USB device
134+
- Evil Maid attacks
135+
136+
#### [Attack Complexity (AC)](https://www.first.org/cvss/v4-0/specification-document#Attack-Complexity-AC)
137+
138+
- **Question**: What are the requirements for bypassing security-enhancing conditions/controls?
139+
- **Values**:
140+
- Low (`L`)
141+
- The attack requires no target-specific defense circumvention
142+
- **Examples**:
143+
- Most web attacks
144+
- High (`H`)
145+
- The attack requires evasion or circumvention of security-enhancing techniques in place that would otherwise hinder the attack:
146+
- address space layout randomization (ASLR)
147+
- data execution prevention (DEP)
148+
- Obtaining target-specific secrets
149+
- **Examples**:
150+
- [regreSSHion CVE-2024-6387](https://www.first.org/cvss/v4-0/examples#regreSSHion-CVE-2024-6387)
151+
- Attackers must defeat memory safety defenses in order to achieve code execution
152+
153+
#### [Attack Requirements (AT)](https://www.first.org/cvss/v4-0/specification-document#Attack-Requirements-AT)
154+
155+
- **Question**: Are there any non-security-specific conditions that need to be overcome?
156+
- **Values**:
157+
- None (`N`)
158+
- No special requirements or conditions
159+
- **Examples**:
160+
- Most web attacks
161+
- Present (`P`)
162+
- The attack requires the presence of a specific condition that is not always present
163+
- **Examples**:
164+
- Race condition requiring a very specific timing window
165+
- Man-in-the-Middle (MitM) attacks
166+
167+
#### [Privileges Required (PR)](https://www.first.org/cvss/v4-0/specification-document#Privileges-Required-PR)
168+
169+
- **Question**: What privileges does an attacker need (themselves, not the victim)?
170+
- **Values**:
171+
- None (`N`)
172+
- No need for authentication
173+
- **Examples**:
174+
- SQL injection on the login page
175+
- Low (`L`)
176+
- Authentication required, but only low privileges
177+
- **Examples**:
178+
- Low-privileged user can access the admin panel
179+
- Logged in attacker is able to change other users’ data
180+
- High (`H`)
181+
- Attacker needs significant privileges (e.g. admin)
182+
- **NOTE**: In CVSS we only measure the impact of a vulnerability in terms of what is gained by exploiting it. It wouldn't make sense to score legitimate administrative capabilities as impact.
183+
- **Examples**:
184+
- Exploit only possible through the admin panel of a Web app
185+
- Change of scope vulnerabilities such as a privileged user on a VM/container can escape into the host and execute commands there
186+
187+
#### [User Interaction (UI)](https://www.first.org/cvss/v4-0/specification-document#User-Interaction-UI)
188+
189+
- **Question**: What are the requirements on the user/victim for the attack to succeed?
190+
- **Values**:
191+
- None (`N`)
192+
- Attacker can exploit without any interaction from any user/victim
193+
- **Examples**:
194+
- SQL injection on the login page
195+
- Passive (`P`)
196+
- Requires only limited interaction or normal/ordinary user behaviour
197+
- **Examples**:
198+
- A user will be compromised if they simply open a malicious message/email/sms within the application (not having to further follow any links)
199+
- A malicious user can change their user info so that an account takeover occurs whenever the admin user generates reports (assuming report generation is a normal/expected activity)
200+
- A stored cross-site scripting (XSS) in the default dashboard that loads after user log-in
201+
- Active (`A`)
202+
- Requires a behaviour that is out of the ordinary, against recommended guidance, or subverting security controls
203+
- **Examples**:
204+
- An email with malicious attachment that the victim needs to explicitly download and execute
205+
- The user must explicitly accept/override a security warning such as certificate/TLS issues reported by the browser
206+
- Reflected cross-site scripting (XSS) where the victim needs to follow a malicious link
207+
208+
### Impact Metrics
209+
210+
#### CIA
211+
212+
In CVSS impact is measured against the security properties:
213+
214+
- **Confidentiality (C)**. Attackers can't read data.
215+
- **Integrity (I)**. Attackers can't modify data.
216+
- **Availability (A)**. Attackers can't disrupt the service.
217+
218+
Impact is only measured in terms of what is gained by exploiting a vulnerability. For example, a vulnerability that allows a read-only user to modify some data should only be scored with Integrity impact. The impact should be contained to what can be proven or reasonably expected.
219+
220+
**NOTES**:
221+
222+
- Brute-forcing cryptographically secure algorithms with sufficient key size and entropy should be considered neither reasonable nor practical
223+
- Finding a collision in a hashing function known to be broken (such as SHA-1) has to be considered reasonable (as proven in the shattered attack), even if not computationally/financially feasible for non-financially capable attackers.
224+
225+
#### Scope (Vulnerable System Impact vs Subsequent System Impact)
226+
227+
CVSS v4 introduces separate impact scores for the Vulnerable (`V`) system and Subsequent (`S`) systems (previously in CVSS v3 this used to be marked by a Scope (`S`) metric).
228+
229+
The CVSS documentation includes a [User Guide](https://www.first.org/cvss/v4-0/user-guide#Vulnerable-System-and-Subsequent-System) with some examples on scope scoring.
230+
231+
Examples of change of scope (vulnerable to subsequent) for impact:
232+
233+
- vulnerability in a virtualization hypervisor that allows a virtual machine "escape" from the VM onto the host (similarly, container escape)
234+
- cross-site scripting (XSS) vulnerabilities. The vulnerable system is the web server, but the impacted system (i.e. subsequent) is the victim's web browser.
235+
236+
#### [Confidentiality (VC/SC)](https://www.first.org/cvss/v4-0/specification-document#Confidentiality-VC-SC)
237+
238+
- **Security Property**. Attackers can't read data.
239+
- **Values**:
240+
- None (`N`)
241+
- No impact
242+
- Low (`L`)
243+
- Read access to some restricted data:
244+
- No control over which data
245+
- Amount/kind is limited
246+
- **Examples**:
247+
- Attacker can read internal debug messages and see some internal details (e.g. IP addresses), but no secrets or critical information
248+
- Attacker can see user statistics
249+
- High (`H`)
250+
- Read all data or critical data
251+
- **Examples**:
252+
- SQL injection allowing database dump of the whole database
253+
- Attacker can read another user's access tokens
254+
255+
#### [Integrity (VI/SI)](https://www.first.org/cvss/v4-0/specification-document#Integrity-VI-SI)
256+
257+
- **Security Property**. Attackers can't modify data.
258+
- **Values**:
259+
- None (`N`)
260+
- No impact
261+
- Low (`L`)
262+
- Read access to some restricted data:
263+
- No control over which data
264+
- Amount/kind is limited
265+
- **Examples**:
266+
- Attacker can change another user's avatar image
267+
- High (`H`)
268+
- Modify all data or critical data
269+
- **Examples**:
270+
- SQL injection allowing database modifications
271+
- Attacker can set another user's authentication details (e.g. password, tokens)
272+
273+
274+
#### [Availability (VA/SA)](https://www.first.org/cvss/v4-0/specification-document#Availability-VA-SA)
275+
276+
- **Security Property**. Attackers can't disrupt the service.
277+
- **Values**:
278+
- None (`N`)
279+
- No impact
280+
- Low (`L`)
281+
- Some impact (performance) or partial impact
282+
- **Examples**:
283+
- Computationally intensive cryptographic operation can be abused to partially overload the CPU and cause slower server responses, but cannot completely deny the service
284+
- Attacker can deny some non-critical functionality e.g. report generation
285+
- High (`H`)
286+
- Full service denial or critical parts being denied
287+
- Fully deny access
288+
- Sustained (for the duration of the attack)
289+
- Persistent (even after the attack)
290+
- Deny only access to some critical resources
291+
- User login sessions
292+
- **Examples**:
293+
- Attacker can abuse a particular operation that would overload the server and prevent it from serving clients for the next 10 seconds. The attacker can sustain the attack with 1 request every 9-10 seconds.
294+
- Attacker can send a malformed request the would crash the server. The service will no longer be available until it is manually restarted.
295+
- Attacker can break the login functionality. Existing sessions remain intact, but users cannot sign in anymore (sustained or persistent).
296+
297+
298+
---
299+
300+
**Resources**:
301+
302+
- CVSS Documentation: [https://www.first.org/cvss/](https://www.first.org/cvss/)
303+
- CVSS 4.0 Calculator: [https://www.first.org/cvss/calculator/4-0](https://www.first.org/cvss/calculator/4-0)
304+
- CVSS Examples: [https://www.first.org/cvss/v4-0/examples](https://www.first.org/cvss/v4-0/examples)
305+
- CVSS User Guide: [https://www.first.org/cvss/v4-0/user-guide](https://www.first.org/cvss/v4-0/user-guide)

‎trainingportal/static/lessons/cvss/cvss_intro.sol.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
The CVSS specification is available at [https://www.first.org/cvss/](https://www.first.org/cvss/).

‎trainingportal/static/lessons/cvss/definitions.json‎

Lines changed: 10 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,30 @@
11
[
22
{
33
"level":0,
4-
"name":"Vulnerability Investigator",
4+
"name":"CVSS",
55
"challenges":[
66
{
77
"id":"cvss_intro",
8-
"name":"About CVSS",
8+
"name":"Introduction",
99
"description": "cvss_intro.md",
1010
"solution": "cvss_intro.sol.md",
1111
"type":"quiz",
12-
"mission":"Choose the correct option",
12+
"mission":"Which organization is responsible for the CVSS specification?",
1313
"options":[
1414
{
15-
"display":"Confidentiality: High, Integrity: High, Availability: High",
16-
"value":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
15+
"display":"FIRST - Forum of Incident Response and Security Teams (https://www.first.org/)",
16+
"value":"1"
1717
},
1818
{
19-
"display":"Confidentiality: High, Integrity: High, Availability: None",
20-
"value":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
19+
"display":"NVD - National Vulnerability Database (https://nvd.nist.gov/)",
20+
"value":"2"
2121
},
2222
{
23-
"display":"Confidentiality: High, Integrity: None, Availability: None",
24-
"value":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
25-
},
26-
{
27-
"display":"Confidentiality: None, Integrity: None, Availability: None",
28-
"value":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N"
23+
"display":"OWASP - Open Worldwide Application Security Project (https://owasp.org/)",
24+
"value":"3"
2925
}
3026
],
31-
"answer":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
27+
"answer":"1",
3228
"codeBlockIds":[]
3329
}
3430
]

0 commit comments

Comments
 (0)