Skip to content

Commit 49bf7e3

Browse files
ziadhanyziadhany
committed
Add support for Calculating Risk in VulnerableCode
Signed-off-by: ziadhany <ziadhany2016@gmail.com>
1 parent e90c465 commit 49bf7e3

5 files changed

Lines changed: 306 additions & 0 deletions

File tree

‎vulnerabilities/risk.py‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
import os
2+
import re
3+
4+
from vulnerabilities.models import Exploit
5+
from vulnerabilities.models import Package
6+
from vulnerabilities.models import PackageRelatedVulnerability
7+
from vulnerabilities.models import Vulnerability
8+
from vulnerabilities.models import VulnerabilityReference
9+
from vulnerabilities.severity_systems import EPSS
10+
from vulnerabilities.utils import load_json
11+
12+
BASE_DIR = os.path.dirname(os.path.abspath(__file__))
13+
14+
15+
def get_weighted_severity(severities):
16+
"""
17+
Weighted Severity is the maximum value obtained when each Severity is multiplied
18+
by its associated Weight/10.
19+
Example of Weighted Severity: max(7*(10/10), 8*(3/10), 6*(8/10)) = 7
20+
"""
21+
weight_config_path = os.path.join(BASE_DIR, "..", "weight_config.json")
22+
weight_config = load_json(weight_config_path)
23+
24+
score_map = {
25+
"low": 3,
26+
"moderate": 6.9,
27+
"medium": 6.9,
28+
"high": 8.9,
29+
"important": 8.9,
30+
"critical": 10.0,
31+
"urgent": 10.0,
32+
}
33+
34+
score_list = []
35+
for severity in severities:
36+
weights = [
37+
value
38+
for regex_key, value in weight_config.items()
39+
if re.match(regex_key, severity.reference.url)
40+
]
41+
42+
if not weights:
43+
return 0
44+
45+
max_weight = float(max(weights)) / 10
46+
vul_score = severity.value
47+
try:
48+
vul_score = float(vul_score)
49+
vul_score_value = vul_score * max_weight
50+
except ValueError:
51+
vul_score = vul_score.lower()
52+
vul_score_value = score_map.get(vul_score, 0) * max_weight
53+
54+
score_list.append(vul_score_value)
55+
return max(score_list) if score_list else 0
56+
57+
58+
def get_exploitability_level(exploits, references, severities):
59+
"""
60+
Exploitability refers to the potential or
61+
probability of a software package vulnerability being exploited by
62+
malicious actors to compromise systems, applications, or networks.
63+
It is determined automatically by discovery of exploits.
64+
"""
65+
# no exploit known ( default .5)
66+
exploit_level = 0.5
67+
68+
if exploits:
69+
# Automatable Exploit with PoC script published OR known exploits (KEV) in the wild OR known ransomware
70+
exploit_level = 2
71+
72+
elif severities:
73+
# high EPSS.
74+
epss = severities.filter(
75+
scoring_system=EPSS.identifier,
76+
)
77+
epss = any(float(epss.value) > 0.8 for epss in epss)
78+
if epss:
79+
exploit_level = 2
80+
81+
elif references:
82+
# PoC/Exploit script published
83+
ref_exploits = references.filter(
84+
reference_type=VulnerabilityReference.EXPLOIT,
85+
)
86+
if ref_exploits:
87+
exploit_level = 1
88+
89+
return exploit_level
90+
91+
92+
def calculate_vulnerability_risk(vulnerability: Vulnerability):
93+
"""
94+
Risk may be expressed as a number ranging from 0 to 10.
95+
Risk is calculated from weighted severity and exploitability values.
96+
It is the maximum value of (the weighted severity multiplied by its exploitability) or 10
97+
98+
Risk = min(weighted severity * exploitability, 10)
99+
"""
100+
# TODO try to use a prefetch
101+
references = vulnerability.references.all()
102+
severities = vulnerability.severities.all()
103+
exploits = Exploit.objects.filter(vulnerability=vulnerability)
104+
105+
weighted_severity = get_weighted_severity(severities)
106+
exploitability = get_exploitability_level(exploits, references, severities)
107+
return min(weighted_severity * exploitability, 10)
108+
109+
110+
def calculate_pkg_risk(package: Package):
111+
"""
112+
Calculate the risk for a package by iterating over all vulnerabilities that affects this package
113+
and determining the associated risk.
114+
"""
115+
116+
result = []
117+
for pkg_related_vul in PackageRelatedVulnerability.objects.filter(package=package, fix=False):
118+
if pkg_related_vul:
119+
risk = calculate_vulnerability_risk(pkg_related_vul.vulnerability)
120+
result.append(risk)
121+
122+
if not result:
123+
return
124+
125+
return f"{max(result):.2f}"

‎vulnerabilities/templates/package_details.html‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,16 @@
112112
{% endif %}
113113
</td>
114114
</tr>
115+
<tr>
116+
<td class="two-col-left">
117+
Risk
118+
</td>
119+
<td class="two-col-right">
120+
{% if risk %}
121+
<a target="_self">{{ risk }}</a>
122+
{% endif %}
123+
</td>
124+
</tr>
115125
</tbody>
116126
</table>
117127
</div>

‎vulnerabilities/tests/test_risk.py‎

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
import pytest
2+
3+
from vulnerabilities.models import Exploit
4+
from vulnerabilities.models import Vulnerability
5+
from vulnerabilities.models import VulnerabilityReference
6+
from vulnerabilities.models import VulnerabilityRelatedReference
7+
from vulnerabilities.models import VulnerabilitySeverity
8+
from vulnerabilities.models import Weakness
9+
from vulnerabilities.risk import calculate_vulnerability_risk
10+
from vulnerabilities.risk import get_exploitability_level
11+
from vulnerabilities.risk import get_weighted_severity
12+
from vulnerabilities.severity_systems import CVSSV3
13+
from vulnerabilities.severity_systems import EPSS
14+
from vulnerabilities.severity_systems import GENERIC
15+
16+
17+
@pytest.fixture
18+
@pytest.mark.django_db
19+
def vulnerability():
20+
vul = Vulnerability(vulnerability_id="VCID-Existing")
21+
vul.save()
22+
23+
reference1 = VulnerabilityReference.objects.create(
24+
reference_id="",
25+
url="https://nvd.nist.gov/vuln/detail/CVE-xxxx-xxx1",
26+
)
27+
28+
VulnerabilitySeverity.objects.create(
29+
reference=reference1,
30+
scoring_system=CVSSV3.identifier,
31+
scoring_elements="CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N/E:H/RL:O/RC:R/CR:H/MAC:H/MC:L",
32+
value="6.5",
33+
)
34+
35+
VulnerabilitySeverity.objects.create(
36+
reference=reference1,
37+
scoring_system=GENERIC.identifier,
38+
value="MODERATE", # 6.9
39+
)
40+
41+
VulnerabilityRelatedReference.objects.create(reference=reference1, vulnerability=vul)
42+
43+
weaknesses = Weakness.objects.create(cwe_id=119)
44+
vul.weaknesses.add(weaknesses)
45+
return vul
46+
47+
48+
@pytest.fixture
49+
@pytest.mark.django_db
50+
def exploit():
51+
vul = Vulnerability(vulnerability_id="VCID-Exploit")
52+
vul.save()
53+
return Exploit.objects.create(vulnerability=vul, description="exploit description")
54+
55+
56+
@pytest.fixture
57+
@pytest.mark.django_db
58+
def vulnerability_with_exploit_ref():
59+
vul = Vulnerability(vulnerability_id="VCID-Exploit-Ref")
60+
vul.save()
61+
62+
reference_exploit = VulnerabilityReference.objects.create(
63+
reference_id="",
64+
reference_type=VulnerabilityReference.EXPLOIT,
65+
url="https://nvd.nist.gov/vuln/detail/CVE-xxxx-xxxx2",
66+
)
67+
68+
VulnerabilityRelatedReference.objects.create(reference=reference_exploit, vulnerability=vul)
69+
return vul
70+
71+
72+
@pytest.fixture
73+
@pytest.mark.django_db
74+
def high_epss_score():
75+
vul = Vulnerability(vulnerability_id="VCID-HIGH-EPSS")
76+
vul.save()
77+
78+
reference1 = VulnerabilityReference.objects.create(
79+
reference_id="",
80+
url="https://nvd.nist.gov/vuln/detail/CVE-xxxx-xxx3",
81+
)
82+
83+
VulnerabilitySeverity.objects.create(
84+
reference=reference1,
85+
scoring_system=EPSS.identifier,
86+
value=".9",
87+
)
88+
89+
VulnerabilityRelatedReference.objects.create(reference=reference1, vulnerability=vul)
90+
return vul.severities
91+
92+
93+
@pytest.fixture
94+
@pytest.mark.django_db
95+
def low_epss_score():
96+
vul = Vulnerability(vulnerability_id="VCID-LOW-EPSS")
97+
vul.save()
98+
99+
reference1 = VulnerabilityReference.objects.create(
100+
reference_id="",
101+
url="https://nvd.nist.gov/vuln/detail/CVE-xxxx-xxx4",
102+
)
103+
104+
VulnerabilitySeverity.objects.create(
105+
reference=reference1,
106+
scoring_system=EPSS.identifier,
107+
value=".3",
108+
)
109+
110+
VulnerabilityRelatedReference.objects.create(reference=reference1, vulnerability=vul)
111+
return vul.severities
112+
113+
114+
@pytest.mark.django_db
115+
def test_exploitability_level(
116+
exploit,
117+
vulnerability_with_exploit_ref,
118+
high_epss_score,
119+
low_epss_score,
120+
vulnerability,
121+
):
122+
123+
assert get_exploitability_level(exploit, None, None) == 2
124+
125+
assert get_exploitability_level(None, None, high_epss_score) == 2
126+
127+
assert get_exploitability_level(None, None, low_epss_score) == 0.5
128+
129+
assert (
130+
get_exploitability_level(
131+
None,
132+
vulnerability_with_exploit_ref.references,
133+
vulnerability_with_exploit_ref.severities,
134+
)
135+
== 1
136+
)
137+
138+
assert get_exploitability_level(None, None, None) == 0.5
139+
140+
141+
@pytest.mark.django_db
142+
def test_get_weighted_severity(vulnerability):
143+
severities = vulnerability.severities.all()
144+
assert get_weighted_severity(severities) == 6.210000000000001
145+
146+
reference2 = VulnerabilityReference.objects.create(
147+
reference_id="",
148+
url="https://security-tracker.debian.org/tracker/CVE-2019-13057",
149+
)
150+
151+
VulnerabilitySeverity.objects.create(
152+
reference=reference2,
153+
scoring_system=GENERIC.identifier,
154+
value="CRITICAL",
155+
)
156+
157+
VulnerabilityRelatedReference.objects.create(reference=reference2, vulnerability=vulnerability)
158+
new_severities = vulnerability.severities.all()
159+
assert get_weighted_severity(new_severities) == 9
160+
161+
162+
@pytest.mark.django_db
163+
def test_calculate_vulnerability_risk(vulnerability):
164+
assert calculate_vulnerability_risk(vulnerability) == 3.1050000000000004

‎vulnerabilities/views.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
from vulnerabilities.forms import PackageSearchForm
3232
from vulnerabilities.forms import VulnerabilitySearchForm
3333
from vulnerabilities.models import VulnerabilityStatusType
34+
from vulnerabilities.risk import calculate_pkg_risk
3435
from vulnerabilities.severity_systems import EPSS
3536
from vulnerabilities.severity_systems import SCORING_SYSTEMS
3637
from vulnerabilities.utils import get_severity_range
@@ -122,6 +123,7 @@ def get_context_data(self, **kwargs):
122123
context["fixing_vulnerabilities"] = package.fixing.order_by("vulnerability_id")
123124
context["package_search_form"] = PackageSearchForm(self.request.GET)
124125
context["fixed_package_details"] = package.fixed_package_details
126+
context["risk"] = calculate_pkg_risk(package)
125127

126128
context["history"] = list(package.history)
127129
return context

‎weight_config.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{
2+
"https://nvd\\.nist\\.gov/.*": 9,
3+
"https:\\/\\/security-tracker\\.debian\\.org\\/.*": 9,
4+
"^(?:http|ftp)s?://": 1
5+
}

0 commit comments

Comments
 (0)