Vulnerability Identification and CVSS Scoring

Tags: #◇Computer Science #◇NSSECU2 #◇Cybersecurity #◇Vulnerability Assessment #◇CVSS #◇Nessus #◇Nuclei #◇Risk Management

◇Overview

Vulnerability identification bridges the gap between raw enumeration data and actionable risk analysis. By combining automated vulnerability scanners (e.g., Nessus, OpenVAS, Nuclei) with rigorous manual verification, ethical hackers discover configuration errors, unpatched software flaws, and missing defensive controls. To objectively quantify and communicate the severity of discovered flaws to organizational leadership, the industry relies on the Common Vulnerability Scoring System (CVSS v3.1), a standardized mathematical framework evaluating exploitability, scope, and impact metrics.

◇Key Definitions

• Vulnerability Scanner: An automated software tool that inspects target systems against a database of known signatures, CVEs, and configuration checks to identify security weaknesses.
• Unauthenticated (Network) Scan: A scan performed from the perspective of an external adversary without user credentials; focuses on exposed listening daemons and public perimeter flaws.
• Authenticated (Credentialed) Scan: A scan performed using valid system or administrative credentials; logs into the target host to inspect installed package versions, local registry keys, configuration files, and missing security patches.
• True Positive: A real, verifiable vulnerability correctly identified by a scanner or analyst.
• False Positive: A reported vulnerability that does not actually exist or is not exploitable in the target's operating environment (e.g., due to backported patches).
• False Negative: An existing vulnerability that the scanner fails to detect.
• CVSS (Common Vulnerability Scoring System): An open, vendor-agnostic framework maintained by FIRST (Forum of Incident Response and Security Teams) for assessing the severity of computer system security vulnerabilities.
• CVSS Base Score: A numeric value ranging from $0.0$ to $10.0$ representing the inherent technical severity of a vulnerability based on its exploitability and impact qualities.
• Vector String: A standardized textual representation of the specific metric values chosen during a CVSS evaluation (e.g., CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

◇Vulnerability Scanning Technologies & Methodologies

1. Tool Ecosystem Comparison

Modern vulnerability assessment utilizes distinct scanning engines depending on engagement requirements:

# 1. Nmap Vulners Script Integration
nmap -sV --script vulners -p 21,22,80,443,8080 192.168.10.45 -oN nmap_vulners.txt

# 2. Targeted Web Assessment via ProjectDiscovery Nuclei
nuclei -u http://192.168.10.45/ -t cves/ -t exposures/ -severity medium,high,critical -o nuclei_report.txt

2. Authenticated vs. Unauthenticated Scanning

UNAUTHENTICATED SCAN (External Perimeter Perspective)
Scanner ------------ Network Probes ------------> [ Exposed Ports / Public Banners ]
-> Checks: Open ports, banner matching, default web files, public SSL certificates.
-> Risk: High false positives on banner checks; zero visibility into internal libraries.

AUTHENTICATED SCAN (Internal System Auditor Perspective)
Scanner -- SSH / SMB Credentialed Login --> [ Kernel, Package Manager, Registry, Local FS ]
-> Checks: `dpkg -l`, `rpm -qa`, registry keys, file permissions, internal service configs.
-> Benefit: Near-zero false positives, identifies missing local OS patches and library CVEs.

◇CVSS v3.1 Scoring Framework & Mathematical Formulation

CVSS v3.1 calculates a Base Score ranging from $0.0$ to $10.0$ structured into two metric sub-groups: Exploitability Metrics and Impact Metrics, modified by the Scope metric.

+-----------------------------------------------------------------------------------+
|                            CVSS v3.1 BASE METRIC MATRIX                           |
+-----------------------------------------------------------------------------------+
|  1. EXPLOITABILITY METRICS (Measures ease and conditions of attack)               |
|     - Attack Vector (AV):           Network (N), Adjacent (A), Local (L), Physical (P) |
|     - Attack Complexity (AC):       Low (L), High (H)                            |
|     - Privileges Required (PR):     None (N), Low (L), High (H)                   |
|     - User Interaction (UI):        None (N), Required (R)                        |
+-----------------------------------------------------------------------------------+
|  2. SCOPE METRIC (Measures authorization boundary traversal)                       |
|     - Scope (S):                    Unchanged (U), Changed (C)                    |
+-----------------------------------------------------------------------------------+
|  3. IMPACT METRICS (Measures consequence of successful compromise)                |
|     - Confidentiality Impact (C):   None (N), Low (L), High (H)                   |
|     - Integrity Impact (I):         None (N), Low (L), High (H)                   |
|     - Availability Impact (A):      None (N), Low (L), High (H)                   |
+-----------------------------------------------------------------------------------+

1. Base Metric Numerical Values

$\text{Attack Vector (AV)} = \begin{cases} 0.85 & \text{Network (N)} \\ 0.62 & \text{Adjacent Network (A)} \\ 0.55 & \text{Local (L)} \\ 0.20 & \text{Physical (P)} \end{cases}$

$\text{Attack Complexity (AC)} = \begin{cases} 0.77 & \text{Low (L)} \\ 0.44 & \text{High (H)} \end{cases}$

$\text{User Interaction (UI)} = \begin{cases} 0.85 & \text{None (N)} \\ 0.62 & \text{Required (R)} \end{cases}$

$\text{Privileges Required (PR)} = \begin{cases} 0.85 & \text{None (N)} \\ 0.62 \text{ (Scope Unchanged) or } 0.68 \text{ (Scope Changed)} & \text{Low (L)} \\ 0.27 \text{ (Scope Unchanged) or } 0.50 \text{ (Scope Changed)} & \text{High (H)} \end{cases}$

$\text{Impact Components (C, I, A)} = \begin{cases} 0.00 & \text{None (N)} \\ 0.22 & \text{Low (L)} \\ 0.56 & \text{High (H)} \end{cases}$

2. Severity Rating Scale

◇Worked CVSS Calculation Scenarios

Scenario 1: Unauthenticated Environment Variable & Debug Disclosure

• Scenario Details: An unauthenticated remote attacker accesses http://target.com/.env and retrieves database credentials and secret API signing keys.
• Metric Evaluation:
  • AV: Network (N) $\rightarrow 0.85$
  • AC: Low (L) $\rightarrow 0.77$ (No special conditions required)
  • PR: None (N) $\rightarrow 0.85$ (No credentials needed)
  • UI: None (N) $\rightarrow 0.85$ (No victim interaction)
  • S: Unchanged (U) (Applies strictly to web application)
  • C: High (H) $\rightarrow 0.56$ (Complete read access to all secrets)
  • I: None (N) $\rightarrow 0.00$ (No modification capability directly through file read)
  • A: None (N) $\rightarrow 0.00$ (No service disruption)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Calculated Base Score: 7.5 - High Severity

Scenario 2: Unauthenticated SQL Injection in Authentication Portal

• Scenario Details: An unauthenticated remote attacker injects ' OR 1=1-- into a login form, bypassing authentication, reading customer records, modifying admin accounts, and executing xp_cmdshell to shut down the server.
• Metric Evaluation:
  • AV: Network (N) $\rightarrow 0.85$
  • AC: Low (L) $\rightarrow 0.77$
  • PR: None (N) $\rightarrow 0.85$
  • UI: None (N) $\rightarrow 0.85$
  • S: Unchanged (U)
  • C: High (H) $\rightarrow 0.56$
  • I: High (H) $\rightarrow 0.56$
  • A: High (H) $\rightarrow 0.56$
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Calculated Base Score: 9.8 - Critical Severity

Scenario 3: Stored Cross-Site Scripting (XSS) with Scope Change

• Scenario Details: A low-privileged authenticated user posts a malicious JavaScript payload in a comment board. When an administrator views the page, the script executes in the administrator's browser session, stealing their session cookie and administrative token.
• Metric Evaluation:
  • AV: Network (N) $\rightarrow 0.85$
  • AC: Low (L) $\rightarrow 0.77$
  • PR: Low (L) $\rightarrow 0.68$ (Requires standard authenticated user account)
  • UI: Required (R) $\rightarrow 0.62$ (Victim admin must view the comment)
  • S: Changed (C) (Vulnerability in web server impacts victim user's browser runtime environment)
  • C: Low (L) $\rightarrow 0.22$ (Exposes cookie data)
  • I: Low (L) $\rightarrow 0.22$ (Can perform actions on user's behalf)
  • A: None (N) $\rightarrow 0.00$
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Calculated Base Score: 5.4 - Medium Severity

◇False Positive Analysis & Verification Workflows

Automated scanners are prone to errors. Analysts must follow a systematic elimination protocol before reporting findings:

+-----------------------------------------------------------------------------------+
|                        FALSE POSITIVE ELIMINATION WORKFLOW                        |
+-----------------------------------------------------------------------------------+
|  1. Inspect Underlying Scanner Plugin / Rule                                      |
|     -> Was the finding triggered solely by a banner string check (e.g. Apache 2.4)?|
+-----------------------------------------------------------------------------------+
|  2. Check for Operating System Backporting                                        |
|     -> Red Hat / Ubuntu backport security fixes without changing version numbers. |
|     -> Verify package release: `dpkg -l apache2` or `rpm -q httpd`.               |
+-----------------------------------------------------------------------------------+
|  3. Safe Manual Proof of Concept (PoC) Validation                                 |
|     -> Perform non-destructive request replay to verify the presence of the bug.  |
|     -> If the system does not respond with expected vulnerable behavior, dismiss. |
+-----------------------------------------------------------------------------------+

◇References & Navigation

• Previous Topic: ◇Enumeration
• Next Topic: ◇Attack Path Development
• Related Notes: ◇Attack Path Development, ◇Web Application Pentesting