vulnrichment - A repo to conduct vulnerability enrichment.

项目说明

CISA

The CISA project is the public repository of CISA's enrichment of public C through CISA's ADP (Authorized Data Publisher) container. In this phase of the project, CISA is assessing new and recent CVEs and adding key SSVC decision points. Once scored, some higher-risk CVEs will also recei of CWE and/or CVSS data points, where possible.

Producers and consumers of this CVE data should already be familiar with the current C Format and can access this data in the normal ways, including the GitHub API and the C API. Note that the results of are being pushed back to the C, through the recently (2024) launched ADP Program. Downstream consumers need not fork and track this GitHub repo if they are already consuming live CVE data.

This project is under acti, so keep an eye on this README.md for updates.

How it works

First, CISA will take each C an SS process.

Next, for those CVEs that are rated as "Total Technical Impact," "Automatable," or have "Exploitation" of "Proof of Concept" or "Acti," further analysis will be conducted. CISA will determine if there is enough information to assert a specific CWE identifier and/or a C. In some cases, CISA will provide these metrics even to that do not rate as high risk on any of these decision points.

For those CVEs that do not already ha fields populated by the originating CNA, CISA will populate the associated ADP container with those when there is enough supporting e to do so. At no point will CISA o the originating CNA's data in the original CNA container in the C.

These flowcharts illustrate the process. Please note that the details in the flowcharts are subject to change as processes are refined.

Some example CVEs

Let's take a moment to look at some C for each kind of you can expect from the CISA ADP.

All of the C as examples below were chosen at random among those that fit the demonstrated criteria.

#### SS points

Every C by the CISA ADP will ha SS points listed. For these examples, we'll take a look at C, C, and C. We'll also look at C, which is a low-risk SS.

C has a "poc" value for Exploit on line 47 indicating there was a public proof-of-concept a at the time of analysis:

C has a "yes" value for "Automatable" on line 50 indicating that an attacker could generally exploit this at will, without having to worry about recon, weaponization, delivery, or exploitation pre techniques.

C has a "total" value for "Technical Impact" on line 59 indicating that the exploiting this generally will give the attacker total control over the impacted software.

#### KEV flag

For those CVEs that are on the KEV, the CISA ADP will add a KE. For those that aren't, no update will occur.

C is one such CVE, and contains the KE starting at line 153:

#### CWE identifiers

C is an example C the originating CNA did not provide a CWE, and a CISA analyst was able to determine one from the context of the information a. That metric starts on line 49 under the problemTypes node:

#### C

C is an example CVE that had a C added by CISA, starting on line 30. Again, this is based on the context of the information a at the time of analysis.

#### CPE strings

Please note that as of December 10, 2024, CISA will no longer be adding CPE strings to the enriched dataset. Pre enriched data may still contain CPE information. The notes here regarding CPE strings are for historical purposes.

C is an example CVE that had a CPE string added by CISA, starting on line 61.

#### No additional updates

C is an example CVE that already had CWE, CVSS, and CPE metrics (see here) when CISA performed the SS step, and it's not on the KEV, so nothing more needed to be added. Good job, Red Hat CNA!

A note about updated C

Since the CISA ADP is committed to encouraging CNAs to Do The Right Thing and provide their own CWE, CVSS, and CPE data, if a C is updated to include that data after the CISA ADP has made their assessment, the CISA ADP will drop its own assessments from the C. This approach will reduce duplicate (and conflicting) data within the C. In the rare event that there is CWE, CVSS, or CPE data provided by the originating CNA *and* the CISA ADP, this should be treated as an error in the CISA ADP container, and the originating CNA's data should take precedence.

A note about SSVC data

SSVC data is encoded in a way that aligns with the schema for the SS used in the decision tree that generated the data. Currently, CISA is utilizing the CISA Coordinator tree.

The field in SSVC data follows the major.minor.patch con, where major.minor denotes the SS, and patch denotes the decision tree . For the current CISA decision tree, this results in a number of 2.0.3: SS 2.0, CISA Coordinator tree 3.

Updates to the decision tree to conform with updates to SSVC will result in changes to the string. Users consuming this data are urged to observe the when decoding SS to determine how to and process the JSON data.

Issues and pull requests

We want to hear from you, the IT cybersecurity professional community, about and ADP! If you see something, please feel free to say something in the Issues, or e, open a pull request with your suggested fix. Note that if you have an issue with the data from the CNA container, you are encouraged to take that issue up with the responsible CNA directly.

项目信息

开发语言：未知

Star 数：866

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A repo to conduct vulnerability enrichment.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。