diff options
Diffstat (limited to 'cvss/v31vector.go')
-rw-r--r-- | cvss/v31vector.go | 228 |
1 files changed, 27 insertions, 201 deletions
diff --git a/cvss/v31vector.go b/cvss/v31vector.go index 1950e5a..e5e3dff 100644 --- a/cvss/v31vector.go +++ b/cvss/v31vector.go @@ -119,183 +119,9 @@ func isV31VectorString(s string) bool { v31VecRe.MatchString(s) } -// Does the map have at least one of the keys needed for a temporal -// score defined? -func hasTemporalScoreKeys(keys map[Key]v3Metric) bool { - ecm, ecm_ok := keys[v3ExploitCodeMaturity] // E - rl, rl_ok := keys[v3RemediationLevel] // RL - rc, rc_ok := keys[v3ReportConfidence] // RC - - return (ecm_ok && ecm != v3ENotDefined) || - (rl_ok && rl != v3RLNotDefined) || - (rc_ok && rc != v3RCNotDefined) -} - -// Does the map have at least one of the keys needed for an env score to -// be defined? -func hasEnvScoreKeys(keys map[Key]v3Metric) bool { - mav, mav_ok := keys[v3ModifiedAttackVector] // MAV - mac, mac_ok := keys[v3ModifiedAttackComplexity] // MAC - mpr, mpr_ok := keys[v3ModifiedPrivilegesRequired] // MPR - mui, mui_ok := keys[v3ModifiedUserInteraction] // MUI - ms, ms_ok := keys[v3ModifiedScope] // MS - mc, mc_ok := keys[v3ModifiedConfidentiality] // MC - mi, mi_ok := keys[v3ModifiedIntegrity] // MI - ma, ma_ok := keys[v3ModifiedAvailability] // MA - cr, cr_ok := keys[v3ConfidentialityRequirement] // CR - ir, ir_ok := keys[v3IntegrityRequirement] // IR - ar, ar_ok := keys[v3AvailabilityRequirement] // AR - - return (mav_ok && mav != v3MAVNotDefined) || - (mac_ok && mac != v3MACNotDefined) || - (mpr_ok && mpr != v3MPRNotDefined) || - (mui_ok && mui != v3MUINotDefined) || - (ms_ok && ms != v3MSNotDefined) || - (mc_ok && mc != v3MCNotDefined) || - (mi_ok && mi != v3MINotDefined) || - (ma_ok && ma != v3MANotDefined) || - (cr_ok && cr != v3CRNotDefined) || - (ir_ok && ir != v3IRNotDefined) || - (ar_ok && ar != v3ARNotDefined); -} - -// roundup implemention (from CVSS v3.1 spec, appendix A) -func roundup(val float64) float64 { - return math.Ceil(10.0 * val) / 10.0 -} - -var v31MetricCoefs = map[v3Metric]float64 { - v3AVNetwork: 0.85, // AV:N - v3AVAdjacentNetwork: 0.62, // AV:A - v3AVLocal: 0.55, // AV:L - v3AVPhysical: 0.2, // AV:P - - v3ACLow: 0.77, // AC:L - v3ACHigh: 0.44, // AC:H - - v3PRNone: 0.85, // PR:N - v3PRLow: 0.62, // PR:L - v3PRHigh: 0.27, // PR:H - - v3UINone: 0.85, // UI:N - v3UIRequired: 0.62, // UI:R - - v3CHigh: 0.56, // C:H - v3CLow: 0.22, // C:L - v3CNone: 0.0, // C:N - - v3IHigh: 0.56, // I:H - v3ILow: 0.22, // I:L - v3INone: 0.0, // I:N - - v3AHigh: 0.56, // A:H - v3ALow: 0.22, // A:L - v3ANone: 0.0, // A:N - - v3ENotDefined: 1.0, // E:X - v3EHigh: 1.0, // E:H - v3EFunctional: 0.97, // E:F - v3EProofOfConcept: 0.94, // E:P - v3EUnproven: 0.91, // E:U - - v3RLNotDefined: 1.0, // RL:X - v3RLUnavailable: 1.0, // RL:U - v3RLWorkaround: 0.97, // RL:W - v3RLTemporaryFix: 0.96, // RL:T - v3RLOfficialFix: 0.95, // RL:O - - v3RCNotDefined: 1.0, // RC:X - v3RCConfirmed: 1.0, // RC:C - v3RCReasonable: 0.96, // RC:R - v3RCUnknown: 0.92, // RC:U - - v3CRNotDefined: 1.0, // CR:X - v3CRHigh: 1.5, // CR:H - v3CRMedium: 1.0, // CR:M - v3CRLow: 0.5, // CR:L - - v3IRNotDefined: 1.0, // IR:X - v3IRHigh: 1.5, // IR:H - v3IRMedium: 1.0, // IR:M - v3IRLow: 0.5, // IR:L - - v3ARNotDefined: 1.0, // AR:X - v3ARHigh: 1.5, // AR:H - v3ARMedium: 1.0, // AR:M - v3ARLow: 0.5, // AR:L - - v3MAVNotDefined: 1.0, // MAV:X - v3MAVNetwork: 0.85, // MAV:N - v3MAVAdjacentNetwork: 0.62, // MAV:A - v3MAVLocal: 0.55, // MAV:L - v3MAVPhysical: 0.2, // MAV:P - - v3MACNotDefined: 1.0, // MAC:X - v3MACLow: 0.77, // MAC:L - v3MACHigh: 0.44, // MAC:H - - v3MPRNotDefined: 1.0, // MPR:X - v3MPRNone: 0.85, // MPR:N - v3MPRLow: 0.62, // MPR:L - v3MPRHigh: 0.27, // MPR:H - - v3MUINotDefined: 1.0, // MUI:X - v3MUINone: 0.85, // MUI:N - v3MUIRequired: 0.62, // MUI:R - - v3MCNotDefined: 1.0, // MC:X - v3MCHigh: 0.56, // MC:H - v3MCLow: 0.22, // MC:L - v3MCNone: 0.0, // MC:N - - v3MINotDefined: 1.0, // MI:X - v3MIHigh: 0.56, // MI:H - v3MILow: 0.22, // MI:L - v3MINone: 0.0, // MI:N - - v3MANotDefined: 1.0, // MA:X - v3MAHigh: 0.56, // MA:H - v3MALow: 0.22, // MA:L - v3MANone: 0.0, // MA:N -} - -// map of modified metrics to not defined value and base key -var v31ModMetricDefaults = map[v3Key]struct { - notDefined v3Metric - baseKey v3Key -} { - v3ModifiedAttackVector: { v3MAVNotDefined, v3AttackVector }, - v3ModifiedAttackComplexity: { v3MACNotDefined, v3AttackComplexity }, - v3ModifiedUserInteraction: { v3MUINotDefined, v3UserInteraction }, - v3ModifiedConfidentiality: { v3MCNotDefined, v3Confidentiality }, - v3ModifiedIntegrity: { v3MINotDefined, v3Integrity }, - v3ModifiedAvailability: { v3MANotDefined, v3Availability }, -} - -// Get modified metric coefficient, or fall back to base coefficient if -// modified metric is not defined. -func getModCoef(keys map[Key]v3Metric, key v3Key) float64 { - d := v31ModMetricDefaults[key] - if v, _ := keys[key]; v != d.notDefined { - // return modified metric coefficient - return v31MetricCoefs[v] - } else { - // return base coefficient - return v31MetricCoefs[keys[d.baseKey]] - } -} -// var metricWeightMPR = CVSS31.Weight.PR [MS !== "X" ? MS : S] [MPR !== "X" ? MPR : PR]; // Depends on MS. - -var v31PrivReqCoefs = map[v3Metric]map[bool]float64 { - v3PRNone: map[bool]float64 { false: 0.85, true: 0.85 }, - v3PRLow: map[bool]float64 { false: 0.62, true: 0.68 }, - v3PRHigh: map[bool]float64 { false: 0.27, true: 0.50 }, - v3MPRNone: map[bool]float64 { false: 0.85, true: 0.85 }, - v3MPRLow: map[bool]float64 { false: 0.62, true: 0.68 }, - v3MPRHigh: map[bool]float64 { false: 0.27, true: 0.50 }, -} - // Return numerical scores for this vector. +// +// Reference implementation: https://www.first.org/cvss/calculator/cvsscalc31.js func (v v31Vector) Scores() (Scores, error) { scopeChanged := false modScopeChanged := false @@ -335,29 +161,29 @@ func (v v31Vector) Scores() (Scores, error) { } } - attackVector := v31MetricCoefs[keys[v3AttackVector]] - attackComplexity := v31MetricCoefs[keys[v3AttackComplexity]] - userInteraction := v31MetricCoefs[keys[v3UserInteraction]] - conf := v31MetricCoefs[keys[v3Confidentiality]] - integ := v31MetricCoefs[keys[v3Integrity]] - avail := v31MetricCoefs[keys[v3Availability]] - ecm := v31MetricCoefs[keys[v3ExploitCodeMaturity]] - remediationLevel := v31MetricCoefs[keys[v3RemediationLevel]] - reportConfidence := v31MetricCoefs[keys[v3ReportConfidence]] - confReq := v31MetricCoefs[keys[v3ConfidentialityRequirement]] - availReq := v31MetricCoefs[keys[v3AvailabilityRequirement]] - integReq := v31MetricCoefs[keys[v3IntegrityRequirement]] + attackVector := v3MetricCoefs[keys[v3AttackVector]] + attackComplexity := v3MetricCoefs[keys[v3AttackComplexity]] + userInteraction := v3MetricCoefs[keys[v3UserInteraction]] + conf := v3MetricCoefs[keys[v3Confidentiality]] + integ := v3MetricCoefs[keys[v3Integrity]] + avail := v3MetricCoefs[keys[v3Availability]] + ecm := v3MetricCoefs[keys[v3ExploitCodeMaturity]] + remediationLevel := v3MetricCoefs[keys[v3RemediationLevel]] + reportConfidence := v3MetricCoefs[keys[v3ReportConfidence]] + confReq := v3MetricCoefs[keys[v3ConfidentialityRequirement]] + availReq := v3MetricCoefs[keys[v3AvailabilityRequirement]] + integReq := v3MetricCoefs[keys[v3IntegrityRequirement]] // adjust privsRequired based on scopeChanged // (CVSS v3.1 spec, section 7.4, table 16) - privsRequired := v31PrivReqCoefs[keys[v3PrivilegesRequired]][scopeChanged] + privsRequired := v3PrivReqCoefs[keys[v3PrivilegesRequired]][scopeChanged] - modAttackVector := getModCoef(keys, v3ModifiedAttackVector) - modAttackComplexity := getModCoef(keys, v3ModifiedAttackComplexity) - modUserInteraction := getModCoef(keys, v3ModifiedUserInteraction) - modConf := getModCoef(keys, v3ModifiedConfidentiality) - modInteg := getModCoef(keys, v3ModifiedIntegrity) - modAvail := getModCoef(keys, v3ModifiedAvailability) + modAttackVector := getV3ModCoef(keys, v3ModifiedAttackVector) + modAttackComplexity := getV3ModCoef(keys, v3ModifiedAttackComplexity) + modUserInteraction := getV3ModCoef(keys, v3ModifiedUserInteraction) + modConf := getV3ModCoef(keys, v3ModifiedConfidentiality) + modInteg := getV3ModCoef(keys, v3ModifiedIntegrity) + modAvail := getV3ModCoef(keys, v3ModifiedAvailability) if v, _ := keys[v3ModifiedScope]; v == v3MSNotDefined { // default to base scopeChanged @@ -373,15 +199,15 @@ func (v v31Vector) Scores() (Scores, error) { ms, _ := keys[v3ModifiedScope] if mpr != v3MPRNotDefined && ms != v3MSNotDefined { - modPrivsRequired = v31PrivReqCoefs[mpr][ms == v3MSChanged] + modPrivsRequired = v3PrivReqCoefs[mpr][ms == v3MSChanged] } else if mpr != v3MPRNotDefined && ms == v3MSNotDefined { - modPrivsRequired = v31PrivReqCoefs[mpr][scopeChanged] + modPrivsRequired = v3PrivReqCoefs[mpr][scopeChanged] } else if mpr == v3MPRNotDefined && ms != v3MSNotDefined { - modPrivsRequired = v31PrivReqCoefs[pr][ms == v3MSChanged] + modPrivsRequired = v3PrivReqCoefs[pr][ms == v3MSChanged] } else { // default to base privsRequired // modPrivsRequired = privsRequired - modPrivsRequired = v31PrivReqCoefs[pr][scopeChanged] + modPrivsRequired = v3PrivReqCoefs[pr][scopeChanged] } } @@ -413,13 +239,13 @@ func (v v31Vector) Scores() (Scores, error) { // temporal score (CVSS v3.1 spec, section 7.2) tempScore := 0.0 - if hasTemporalScoreKeys(keys) { + if hasV3TemporalScoreKeys(keys) { tempScore = roundup(baseScore * ecm * remediationLevel * reportConfidence) } // environmental score (CVSS v3.1 spec, section 7.3) envScore := 0.0 - if hasEnvScoreKeys(keys) { + if hasV3EnvScoreKeys(keys) { // modified impact sub score (ISC_m) miss := math.Min( 1 - (1 - confReq * modConf) * (1 - integReq * modInteg) * (1 - availReq * modAvail), |