Skip to content

Improper Input Validation on CVSS v2 parsing #1

@pandatix

Description

@pandatix

Hello, while fuzzing this implementation, I discovered that it is invalidating valid CVSS v2 vectors.
For instance, let's take the NVD CVSS v2 calculator as a reference.
Build any vector with base and environmental metrics different from Not Defined. Let's say (AV:L/AC:M/Au:S/C:N/I:N/A:P/CDP:N/TD:ND/CR:M/IR:ND/AR:ND).

The following Go code shows your implementation does not properly validate it as it raises an error where there should not be.

package main

import (
	"fmt"

	gocvss "github.com/umisama/go-cvss"
)

func main() {
	vec, err := gocvss.ParseVectors("(AV:L/AC:M/Au:S/C:N/I:N/A:P/CDP:N/TD:ND/CR:M/IR:ND/AR:ND)")

	fmt.Printf("vec: %v\n", vec)
	fmt.Printf("err: %v\n", err)
}

produces ->

vec: 
err: invalid vectors string: (AV:L/AC:M/Au:S/C:N/I:N/A:P/CDP:N/TD:ND/CR:M/IR:ND/AR:ND)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions