all right good morning defcon
appsec village i am here today to talk
to you about something near and dear to
my heart
something that makes pen testers jump
for joy blue teamers just sitting on the
edge of their seat and i.t
professionals just do their happy dance
that's right i am talking today about
the
common vulnerability scoring system
okay this is pre-recorded so i don't
have any real-time feedback but i'm
going to go ahead and assume everybody's
just jumping up and down
super excited and cheering wildly and
okay look i get it
vulnerability scoring metrics is not the
most exciting topic
what i'd like to do today is take an
opportunity to present it in a fun
and unique light and hopefully you'll be
able to gain a better understanding of
how
cvss and scoring metrics can work for
you
and bring back your organizations to
help better assess
vulnerabilities and their severity a
little bit about myself before we begin
my name is alex hoffman or red wedge x i
am a pen tester red teamer at
viasat a cyber security instructor at
california state
university long beach a ham radio
enthusiast
i'm a husband a father to three great
kids a d d player and dungeon master in
my spare time when i do have spare time
which is not often
also on staff of cactus con which is
arizona's infosec conference
and an admin at the vetcon discord which
is for veterans in
infosec and in general i'm an all-around
great guy if i do say so myself
[Laughter]
and clearly i also have access to
buttons with sound effects and i'm not
afraid to use them so apologies
in advance for that uh i'll go ahead and
throw out the obligatory presentation
and opinions are my own
and have not been vetted or approved by
my employers
okay so we need to have a basic
understanding first about what cbss is
so cvss or the common vulnerability
scoring system is a free and open
industry standard
it's been around since 2005 and the goal
is to measure severity of a
vulnerability while taking into account
risk
you know as a tool that can be used by
both security professionals
and system administrators or product
owners as a pen tester i use it to
provide accurate measurable findings to
my customers
as a defender you can use it to
understand risk as it applies to your
environment
and to triage defense and remediation
recommendations
as a system administrator network
engineer you can use it to prioritize
patching
or better understand ways to reduce risk
using the temporal and environmental
scores that we'll talk about later
so cvss is owned and managed by
first.org i've got a link up on the
screen
to the calculator on first.org for cvss
you can go ahead and pop that into a
browser or just google search for cvss
calculator it's going to be the first or
second thing that comes up
but i will be using screenshots from
that calculator throughout this
presentation
one more caveat i will not be talking
today about the algorithms or formulas
or the math that goes into determining
scores
honestly i'm just a simple caveman so
numbers bigger than 10
confuse and frighten me but we will be
talking about the metrics that go into
the scores and how to use them but not
the math involved specifically
all right so when i mention cvss i'm
guessing the first thing that pops into
everybody's mind
are the qualitative severity ratings
these are those big
red or orange or yellow words like
critical
high medium things that you see on the
top of an executive summary or
in briefings to leadership or even on
your your expos and
nessus output reports and those are
great and they are often accompanied by
a cvss score like 4.2
9.8 and like i said those are really
good to brief to executives
because an executive will look at a
critical 9.8 and go oh
that's really bad we should fix it or a
2.4 low and go that's not so bad i think
we're okay
and that's fine and that's great for
those particular subset
of people looking at them but it's
lacking a
good bit of context and what i mean by
that is the question i get asked
often when i'm briefing the qsrs and the
cvss score is
how did you get that number because i
could just say yeah it's a critical
and you know people are going to look at
me and say why is it critical how did
you determine it's a critical
did you just pull that number out of
thin air is there some sort of
super-secret rubric
that you're using to try to determine
that and so the piece that's missing
here
is what's called the cvss vector string
the cvss vector string
is a text representation of a set of cvs
metrics
it looks like this and it's used to
impart
to the person that's that's receiving
the report person on the other side of
the table
everything that went into your decision
as an assessor
on why you decided this was critical
high medium or whatever score it was
so you're able to give the person more
details than just it's bad and explain
what made you come to the decision it's
bad or not bad
what about it specifically is bad why is
this vulnerability severe
why isn't it how can you understand it
better
and here's another interesting tidbit
according to the user's guide for cvss
whenever you publish a score and a qsr
you're actually required to also provide
the scoring vector string
so that others can understand how the
score was derived
and and to be quite frank i've looked at
a lot of pen test reports and a lot of
tool outputs
and i rarely see the cdss vector string
you know published with the scores and
and i think that's that's a vital thing
yeah it's required but it's also pretty
vital in order to better
like i said impart the reasons behind
the scoring
to the consumer of the score okay so
quick little story time i was playing
dungeons dragons at work
with some co-workers during lunch like
you know like we do
and i headed back to my office after the
game and i started working on a pen test
report
and as i'm going through writing cvss
vector strings and scores
it dawned on me the similarities between
what i was looking at on the cvss
calculator
and at dungeons dragons character sheet
so what i did is i took
that you know the standard stats block
from d and d
and i formatted it in the same way as a
cvss vector string and it looks
something like this
so if you're a dungeons and dragons
player and i show you this line
you immediately know what i'm trying to
say we're playing dungeons dragons
there's a version number fifth edition
and the characters strength dexterity
constitution intelligence wisdom and
charisma scores right there on the
screen
now as a d d player i'm not going to be
able to give you that single line
and you'll be able to go play that
character you're missing a lot of pieces
of information
things like your initiative bonus
or armor class
weapons all of those things are are
missing from this
but as a d d player if you look at this
you could know a little bit about
this character and why they're capable
of what they're capable of
for example this character is relatively
strong
he has a very high constitution he's
pretty dumb
uh like i said that gives you an
understanding of how they're able to
play the character how the character
thinks acts and does what they do
so what i thought would be a cool way to
figure out how to learn cvss and make it
fun and exciting was to step
through a dungeon adventure we'll
actually play a game of d and d
but instead of using a character sheet
we're going to use a cdss vector string
to step
through this dungeon encounter okay so
i'm going to go ahead and take off my
infosec professional and defcon
presenter hat and put on my dungeon
master robes for a moment
and let's go ahead and introduce you to
our character for this dungeon crawl
this is confluentis he is a dwarf bard
a historian and capable fighter who
travels the realm adventuring
thirsting for knowledge combat and a
good cup of java
all right so we'll meet up with
confluentis and find out about our story
so far
our hero confluentis has wandered the
land of internetia
for 15 years he has traversed at the
sub-oceanic light ways
the series of elven tubes and adventured
beyond the stars and back he has
collected
vast libraries of knowledge and the
monks of the devops monastery
in the land of jura have taken him
as their foretold champion but today
he faces his greatest threat yet he has
ventured far
from home to a place feared by
professionals
today he encounters the tomb
of zero day
confluent is triumphantly storms from
room to room destroying all that stands
in his way
he stands tall uninjured undamaged
he feels it he knows he must be close
the prize will be his the cloak of
invulnerability
must be through this last door he bursts
in
and finds himself face to face with our
villain
cryptokids666 who is
cryptokids666 we don't know
could be a chaotic neutral kid just
trying to see what they can see
could be a lawful evil state actor
trying to bring glory to their homeland
or a corporate entity with nefarious
intentions
trying to steal trade secrets or raise
stock prices
who knows
cryptokid666 quickly thumbs through the
spell book
a rise smile creeping across thin lips
in a long dead language the words flow
casting the ancient spell
of cve 2019-3396
confluence server before 6.6.12
i achieve path traversal via a
server-side template injection weakness
in your wizard connect component
confluentist feels weak and falls to his
knees
cryptokids666 rolls for damage
all right so that brings us to the
attack roll or in cvss terms we are
talking about the base scores
the cvss base score reflects severity
according to its intrinsic
characteristics
it's a worst case scenario in a vacuum
these scores are typically produced and
provided by the organization maintaining
the votable product
or someone on their behalf but the thing
to know about cvss base scores is they
do not change
again these are worst case scenario
scores it does not take into account
the existence of patches or published
pocs
it doesn't matter about your environment
how your system has it deployed
what sort of protections in place the
base score will not
change based on who is assessing the
system
the base score would be the same if this
is an air gap system sitting in a vault
or if it's public facing the internet
with no protections whatsoever
the base score does not change
all right so let's go through each of
these metrics real quick and try and get
an understanding of how they work and
then we'll go ahead and throw our
situation
onto the calculator so the attack vector
is how the attacker would be able to
exploit this vulnerability what path
would they need to take
if it's network it means it's obviously
over a network up to and including the
entire internet
adjacent means it will be limited to
adjacent network topology
like a shared physical or logical
network or secure limited environment
like a vpn
local means i need to have some access
to run commands on the box so think ssh
session
or remote desktop or even reverse shell
and physical means i have to have
physical access to the vulnerable
component i have to be able to touch it
with my hands
and execute things physically being
there
attack complexity these are the things
that the attacker can't control
if something is low complexity it means
it's going to work every time regardless
of extenuating circumstances
where a high complexity means that
there's things beyond the attacker's
control that already have to be in place
or done
before the attacker can exploit the
vulnerability so
it's like a specific component must be
enabled or configured in a very certain
way to make the attack possible
since enabling those components is
beyond the attacker's control
it's considered high complexity
and privileges required these are the
things the attacker already has to have
before
being able to exploit the vulnerability
so none is self-explanatory this is an
unauthenticated vulnerability
low means the attacker already has to
have some user level permissions
like a privilege escalation
vulnerability typically would be low
privileges required
whereas high means they already have to
have privileged access
either root admin nt authority system
things like that
and that's the the difference between
none low and high in privileges required
all right so user interaction basically
this means
does the attack rely on a
user on the system to do something in
order for you to exploit it
so your choices are none or required if
it's required it means
you need them to click a link visit a
website
enable macros on a word document things
like that have to be in
done have to be in place for the attack
to work you're required to have the user
do something
okay and that brings us to scope scope
in my opinion is probably the most
misunderstood
misused and miss scored metric in cvss
it's relatively complicated and so much
so that in the most recent revision 3.1
of cbss
it was actually rewritten to try and
make it easier to understand
so i want to go take a few extra minutes
and talk about scope so we kind of get a
better understanding of how to use it
properly
because i've seen it misused and miss
scored so many times
because as a pen tester when i think of
the word scope i'm thinking of the
things i'm allowed to hack
you know i can get into this box and if
i get into this box i have changed my
scope i've broken scope
or you know the other thing that comes
to mind when i think of scope as far as
vulnerability is
if i can pivot to another host that must
be a change in scope because i've now
gone out of this box
none of that matters in cvss scope
scoring
all right there's some things you need
to identify first before you score scope
you need to identify the vulnerable
component and the impacted component
the vulnerable component is what it
sounds like it's the thing that has the
vulnerability
the impacting component is the thing
that gets pwned
popped denial of service or whatever
once you are able to exploit the
vulnerable component
sometimes those are the same sometimes
they're different all right so once
we've
identified the vulnerable component in
the impact component we need to identify
the security authority for each of them
the security authority is the thing that
controls security for that particular
component
and once we've identified the security
authority for each of those two
different things we compare them
if the if they are under the same
security authority
the scope is unchanged if the security
authority are different they're in
different security scopes
then the scope is changed and we mark it
as such in cbss
all right so let's go through some
examples to make sure that makes sense
um let's go with a vm escape
you're able to escape a virtual machine
that is a
changed scope because the vulnerable
component is the virtual machine
the impact component is the host os and
both of them are controlled by different
security scopes the vm itself has its
own
intrinsic uh authority which would be
the you know the operating system of the
guest
in the vm has its own authentication
mechanism and the host has its own
authentication mechanism as well
and because they have separate
authentication mechanisms if
that becomes a change scope another
example
authentication bypress on a wordpress
site
if the attacker was able to gain
privileges and go from an authenticated
user to an authenticated one
okay the vulnerable component here is
the wordpress site the impact component
is also the wordpress site
since they both have the same security
authority in this case
the wordpress authentication mechanism
it is an
unchanged scope even though you now have
more privileges the scope is still
unchanged conversely a directory
traversal on a wordpress site
that enables you to pop etsy shadow or
etsy password
the vulnerable component is the
wordpress site but the impacted
component is the host
os because you were able to manipulate
or access files on the host
therefore the scope has changed because
wordpress
and the host operating system have
separate security authorities
let's look at a couple more examples
like shell shock the vulnerable
component is the bash shell
the impact component is the operating
system that it lives on
since access to both the operating
system and the bash shell on that host
are controlled by the host
os itself they have the same security
authority they're in the same security
scope
so the scope is unchanged one more
example
reflected cross-site scripting
vulnerable component
is the website with the vulnerability
the impacting component here
is the web browser of the visitor to the
site so that's the victim
since the victim's browser is controlled
by the security scope of the victim's
computer
and the website is controlled by the web
server security scope
those are separate so reflected
cross-site scripting would be a changed
scope i hope that makes sense and if it
doesn't feel free to ask me some
questions later on or if you have
specific use cases
you want want me to look at i'm
available you can
hit me up after this and we can figure
that out
okay so moving on past scope into
the impact metrics these are still part
of the base scores
and these are covering the impact to
confidentiality integrity and
availability
now i'm guessing most of the people
watching this talk have a basic
understanding of the cia triangle
so i'm not going to go into too much
detail about what those mean
but the big question for each of these
metrics to ask yourself is
can the attacker affect cia on some
or all of the data that the system
protects if
the answer is some then it's low if the
answer is all
it's high also if the data they obtain
is privileged or critical data and that
it's considered high even if they can't
attain all of it
um yep so that is the impact metrics
so let's go ahead and take our attack
role
and throw on the specifics of this
vulnerability on the base score
calculator
we've got attack vector network
complexity low
privilege is required none user
interaction none
the scope is changed because the
security authority of the confluence
server is separate from the security
authority of the host
where you're able to do the directory
traversal
confidentiality integrity and
availability impacts are all high
and that brings us to a 10.0 critical on
the cvss calculator
you'll also notice i published the cvs
vector cvss vector string on the bottom
of your screen
you can actually take that string head
to the first.org calculator
put a pound sign at the end of the url
and paste that entire thing starting
with cvss and press
enter and it will load that into the
calculator and it will look like what
you see on your screen
so that's a cool way to be able to share
those strings and if someone gives you a
vector string you can just take it to
the calculator and visualize it pretty
easily
all right so let's step back into our
battle shall we
confluentist feels the exploit land its
crushing blow
penetrating his outer armor and
executing itself deep
into his operating system he calls out
to his maker praying for help
oh great and beautiful atlassian bless
me and heal me
protect me from this evil chat with my
hip
turn the gaze of your fish eye upon your
faithful servant
intervene on my behalf and stride down
to my side o great
and all-powerful collaborator
suddenly a light shines down from above
confluentis feels the healing word of
official fix as his creator atlassia
blesses him
it's coming he hears an ethereal whisper
hold strong child for the patch will be
published after testing
and that brings us to the temporal
scores or temporal scores depending on
how you pronounce it
the temporal scores as the names suggest
are specific factors related to the
vulnerability at a point in time
if you remember we talked about the base
scores the base scores will never change
they stay static the temporal scores
will change based on
industry-wide situations again we're not
taking into account
specific use cases specific deployments
patching versions anything like that
the temporal scores take into account
the situation
of the vulnerability and availability of
exploit right now
as we're scoring it there's three
metrics in the temporal score so let's
go through each of them
exploit code maturity is based on
how prevalent this poc or exploit is and
if it's being exploited in the wild
so a u or
unproven exploit would be it's
theoretical or there's no publicly
available exploit code
p is proof of concept proof of concept
code that's not functional in all
situations or may require substantial
modifications
by someone with a high level of skill f
is functional which means exploit code
is available and it works in most cases
and h or high means that there's
functional autonomous code available
basically this is push button get bacon
there's a reliable exploit that works
every time with easy to use tools like a
metasploit module
things like that this is when when your
unskilled attackers are able to use it
easily
it is considered high exploit code
maturity
all right remediation level this takes
into account the availability of
how to fix it patching hotfixes things
like that
it does not take into account whether or
not you've applied them
just the fact that they exist will lower
the score
things like unavailable workaround
temporary fix or official fix change the
score
report confidence is the degree of
confidence that this vulnerability
actually exists
is it unknown is it reasonable to assume
or is it confirmed that this
component is vulnerable so let's go
ahead and throw the official fix from
our creator atlassia onto the board
if you recall we were at a 10.0 critical
and we have now lowered it to a 9.5
just the fact that there is an official
fix has lowered the overall severity of
the vulnerability
and again we have the updated cvss 3.1
vector string down below
but all is still not well confluentis
is damaged and broken weak and on his
knees
barely able to stand the blessing from
his maker helped a bit
but he is still in critical condition he
is not long
for this world he feels the imminent
shutdown of his functions
and the denial of his service but then
just as his eyes close he hears his
friends approach in the distance
hold the line cisco flame hand screams
as she casts firewall
segregating confluentists from the
internet
we just need to hold until the patch
army arrives
docker bellows enveloping confluence in
a container protecting him from scope
change
ted roberts taps away at his keyboard
casting sanitize pii
removing any sensitive information from
confluentism's backend
and that brings us to the environmental
scores uh so
to recap a little bit base scores will
never change
temporal scores change based on the
situation industry-wide at any given
time
or now when we're creating the
vulnerability uh calculations
the environmental scores are your chance
as the assessor
to take into account specific
deployments versions protections
network situations all of these things
that are specific to your environment or
the environment
the system is deployed in so one thing i
hear a lot
when i talk to people about cvss is that
everything is a 10.0 critical hair on
fire and it just skews so high every
time that everything is an emergency and
when everything's an emergency nothing
is
and i get that and i understand that and
i have seen it but i'll be honest i'm
pretty sure that's on purpose
because again base scores are in a
vacuum they're designed
to be the worst case hair on fire
scenario but using the environmental
scores
the assessor is able to take into
account specifics of a situation
and what that means is that you can
lower the score to
the reasonable and accurate level based
on
how the system is in use currently or
deployed in the environment
okay so let's go through each of these
on the left hand side of the screen
we've got the confidentiality integrity
and availability requirements
these are separate from the impact this
is how important
is the data that the system is
protecting
again specific to your environment so
let's like for example confidentiality
if the if it's a database we're talking
about that contains the social security
numbers of every employee in a company
that has a high requirement for
confidentiality that is not something we
want leaked
or if it's a database that contains all
the intellectual property from our
company
those have a high confidentiality
requirement
but if it's a database that holds the
menus from the last two months of meals
at the corporate cafeteria
the confidentiality requirement is
probably pretty low
so you could change that and that lowers
the overall score because it's not as
big of a deal
and and this is applied to both
confidentiality integrity and
availability
this is not the impact or how bad it
would be if it gets lost but how
important is this information to protect
do we need to be have a strong
requirement to protect confidentiality
integrity availability or not
the other section here is the modified
base metrics
again the main base metrics don't change
but this is your chance to make those
changes to the base matrix metrics
based on the situation so if the system
we're talking about
is you know it was rated high the attack
vector was network because it was over
the internet in the base score
but when you tell me that this system is
air gapped and is sitting in a fault
somewhere
the attack vector is local or physical
because you have to physically have
access to the box to attack an air gap
system
so you would modify the attack vector
down to
physical and that would lower the
overall score
so let's go ahead and take our situation
and
throw it up on the calculator
we have modified the attack vector to
adjacent network by throwing up that
firewall
we have changed the confidentiality
requirement to low by removing all the
important data from the database
and we've made the attack complexity
high and the scope unchanged
by enveloping it in a container so we've
taken what was originally a 10.0
critical
it was lowered down to a 9.5 when we
brought in the temporal metrics
which again is still critical but by
making these changes we have lowered the
overall severity of this vulnerability
for our specific deployment to a 6.9
medium
does that mean we shouldn't fix it of
course not does it mean that it's not
vulnerable
no does it mean we've put protections in
place
that allow us to effectively say our
residual severity is lower and therefore
our residual risk is not as severe
yes that is what we did here the other
thing you can do with these
environmental scores
is if you're given a vulnerability you
can play with them on the calculator and
try and find
what things you can do like putting a
firewall in place or removing data
to lower that overall severity and use
it kind of as a triage tool
and that allows you to figure out the
best return on investment for your time
or the defender's time system
administrator's time in trying to
remediate this
so there's lots of ways we can use the
cvss calculator
to lower our overall severity and thus
lower risk for our organization
in this system
the army has arrived and they've brought
with them
the patch this holy object
when applied to confluentis protects him
from the evil of cve 2019-3396
they make quick work of cryptokid666
who falls to the ground defeated
for now
all right so some takeaways here cvss
isn't just overall scores and pretty
qualitative severity rankings
those things are important and i'm not
saying you shouldn't use those or rely
on them
but there's more to it than that having
a good understanding of the cvss vector
string
allows everybody involved to have a
better understanding of the
vulnerability
and what went into the decision to make
it considered severe
critical high medium low whatever it is
and again it professionals can use these
scores
play with the calculator to try and
adjust what they could best do to lower
the overall severity and residual risk
one more time there's a link to the
first.org calculator up on the screen
feel free to use that and that is just
about it for me
i appreciate everybody's time you can
find me on twitter
redwedgex i'll be on discord immediately
after this
in the defcon discord server at
redwayjax0404
i'm going to throw my slides up this
afternoon on github you're free to use
them with attribution
and you can reach me via email at
redwedgex protonmail.com
a couple quick thank yous i want to
shout out i appreciate defcon absec
village it's been an honor and a
pleasure to be here and speak to
everybody today
thanks to my my esteemed voice actors or
my friends jeff
jeremy and fletcher my wife shira and my
ten-year-old daughter
ziva who voiced the goddess atlassia
and one more thanks to digital overdose
khan where i
workshop this talk earlier this year and
got some great feedback and mentorship i
really appreciate everything from that
and uh yeah i'll be around defcon in
person feel free to look for me
yell at me tell me my talk was garbage
or ask me questions
here or in the live q a immediately
following it and once again thanks
everyone for your time and have a good