Vulnerability Assessment & CVE Research

Prerequisites

• PEN-K003: Active Reconnaissance

Why This Lesson Matters

Finding an open port is not a finding. Finding that port 3306 is internet-facing is a finding. Finding that it is running MySQL 8.0.32 with CVE-2022-21412 (unauthenticated access vulnerability) and then proving it is exploitable — that is a finding worth paying for. This lesson bridges the gap between service inventory and exploitation by teaching systematic vulnerability research and CVSS scoring.

1. From Service to Vulnerability: The Research Chain

Service discovered      → MySQL 8.0.32 on port 3306
         ↓
Version → CVE search    → NVD: CVE-2022-21412 affects MySQL < 8.0.28 → NOT affected
                        → Shodan CVE search, Vulners, ExploitDB
         ↓
Configuration check     → Default credentials? Anonymous access? Weak password?
         ↓
Authenticated checks    → With valid creds: privilege escalation possible?
         ↓
Finding classification  → Severity + CVSS score + business impact

2. CVE Research Sources

# Search ExploitDB from command line
searchsploit "Apache Tomcat 9.0"
# Returns: matching exploits with file paths

# NVD API for specific version
curl "https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=Apache%20Tomcat%209.0.65" | 
  jq '.vulnerabilities[].cve | {id: .id, score: .metrics.cvssMetricV31[0].cvssData.baseScore}'

3. Automated Vulnerability Scanning

3.1 Nessus (Industry Standard)

Nessus is the most widely used commercial vulnerability scanner. Key concepts:

• Credentialed scan: Nessus logs into the target with provided credentials and checks installed software versions, patch levels, and configurations. More accurate; fewer false positives.
• Unauthenticated scan: Remote-only checks. Faster; more false positives.

For a pentest, always request credentialed scan credentials if the client provides them.

Nessus finding severity mapping:
  Critical (CVSS 9.0–10.0) → Prioritise immediately
  High     (7.0–8.9)       → Test in first 48 hours
  Medium   (4.0–6.9)       → Test if time permits
  Low      (0.1–3.9)       → Document; test if specifically asked
  Info                     → Informational; may feed other findings

3.2 Triaging Scanner Output

Scanners produce false positives. Every High/Critical finding requires manual verification before reporting:

# Nessus says: "Apache Tomcat 9.0.65 — Remote Code Execution (CVE-2022-29885)"
# Step 1: Verify the version
curl -I http://target:8080/ | grep Server   # or check /Manager app

# Step 2: Check the CVE
# CVE-2022-29885 affects Tomcat < 9.0.63 — our target is 9.0.65 → NOT vulnerable
# Scanner false positive (version detection error or wrong CVE range)

# Step 3: Document the verification
# "Nessus flagged CVE-2022-29885; manual verification confirmed target runs
#  Tomcat 9.0.65, which is patched. Finding closed as false positive."

4. CVSS v3.1 Scoring

Every finding in a professional pentest report requires a CVSS score. CVSS is a standardised framework for communicating severity.

4.1 The Eight Base Metrics

4.2 Scoring Examples

Internet-facing MySQL with no authentication: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H → 10.0 Critical

• AV:N — reachable from the internet
• AC:L — no special conditions
• PR:N — no credentials needed
• UI:N — no user action
• S:C — scope changes (attacker can reach other systems via DB)
• C/I/A:H — full access to all data

SQLi requiring authentication: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N → 8.8 High

• PR:L — needs low-privilege login first
• S:U — scope unchanged (impact stays in this application)
• A:N — cannot disrupt service via SQLi

5. Manual Verification Techniques

For service-level vulnerabilities, verify manually before exploiting:

# Check if a service is running a vulnerable version
# Apache Tomcat version disclosure
curl http://target:8080/
# Look for version in error pages or /Manager application title

# Check if anonymous FTP is enabled
ftp target
# User: anonymous; Password: anything → if logged in = finding

# Check MySQL for anonymous access
mysql -h target -u "" -e "SELECT user, host FROM mysql.user;"
# If returns results without password = critical finding

6. Common Mistakes

Mistake 1: Reporting scanner output directly without manual verification. A pentest report with unverified scanner findings is not a pentest report — it is a scan report. Every High/Critical must be verified manually.

Mistake 2: CVSS scoring without reading the metric definitions. "AV:N" does not mean "it uses the network." It means the attacker exploits the vulnerability remotely without requiring physical access. Read the CVSS specification.

Mistake 3: Ignoring misconfigurations because they are not CVEs. Internet-facing MySQL with weak credentials is not a CVE — but it is a Critical finding. Misconfigurations, default credentials, and missing controls often have higher impact than known CVEs.

7. Practice Exercises

1. Nessus flags OpenSSL 1.1.1k — Heartbleed (CVE-2014-0160) on a target running OpenSSL 3.0.7. What is wrong with this finding? How do you verify it?

2. Score this finding with CVSS v3.1: "Unauthenticated SQL injection on the public login page that allows extraction of all database contents." Justify each metric.

3. You discover anonymous FTP access on a server that hosts internal financial documents. Write a one-sentence finding title and CVSS score, and describe your verification step.

8. Lab

Assessment mode: quiz

6 questions: research a CVE from a provided service version, calculate CVSS base scores for described vulnerabilities, and identify false positive scanner findings.

9. Framework Alignment

10. Further Reading

• NVD CVSS Calculator — https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator — Interactive scoring tool
• CVSS v3.1 Specification — Full metric definitions (required reading)
• ExploitDB — https://exploit-db.com — The go-to public exploit database

["Execute the five-step research chain from a discovered service to a confirmed vulnerability, using NVD, ExploitDB, and manual version verification", "Calculate a CVSS v3.1 base score for two described vulnerabilities using the eight base metrics, justify each metric selection, and interpret the resulting severity level", "Identify a false positive in a scanner report by manually verifying the running version against the CVE's affected version range"]

Prerequisites → Why this matters → Research chain (5 steps) → CVE sources table → Automated scanning (Nessus credentialed vs unauthenticated, false positive triage) → CVSS v3.1 (8 metrics with values, two scoring examples) → Manual verification techniques → Common mistakes → Practice exercises → Quiz lab → Framework alignment → Further reading