Vulnrichment Playground

Vulnrichment Playground

Speakers: Art Manion (Tharros Labs); Lindsey Cerkovnik (Chief of Vulnerability Response and Coordination, CISA)

Conference: VulnCon

YouTube: https://www.youtube.com/watch?v=hgS0kXkX_HI

Overview

The "Vulnrichment Playground" talk at VulnCon, presented by Lindsey Cerkovnik, Chief of Vulnerability Response and Coordination at CISA, and Art Manion from Tharros Labs, delved into CISA's efforts to enhance and democratize vulnerability information. This presentation highlighted the evolution and ongoing experimentation of Vulnrichment, a CISA initiative designed to inject deeper, more actionable analysis into publicly available CVE records. The core premise is to leverage the extensive vulnerability analysis CISA conducts for federal civilian executive branch (FSEB) agencies and critical infrastructure, making this valuable data accessible to the broader public.

Cerkovnik emphasized CISA's significant operational scale, handling thousands of vulnerability cases annually, coordinating the disclosure of over 2,000 CVEs in FY25, and managing 250-300 coordinated vulnerability disclosure (CVD) cases concurrently. This vast operational footprint generates a wealth of insights that, while mandated for specific stakeholders, possess agnostic value for defenders worldwide. The talk articulates how Vulnrichment serves as the mechanism to share this taxpayer-funded analysis, fostering a more informed and resilient cybersecurity ecosystem.

The "playground" aspect of Vulnrichment signifies an intentional space for experimentation, allowing CISA to test new approaches to vulnerability data enrichment without the rigid constraints of established programs like the Known Exploited Vulnerabilities (KEV) Catalog. This flexibility enables CISA to refine its processes, identify the most impactful data points, and make data-driven decisions about resource allocation. Ultimately, the talk underscores CISA's commitment to continuously improve the utility and quality of vulnerability intelligence available to all defenders.

Background

▶ Watch: CISA's scale in vulnerability disclosure and analysis (0:00)

CISA's role in the cybersecurity landscape is multifaceted, encompassing a wide array of vulnerability-related activities driven by its legislative mandate to protect FSEB agencies and critical infrastructure. This extensive work includes Coordinated Vulnerability Disclosure (CVD), where CISA manages thousands of cases annually with an average 45-day disclosure timeline. Furthermore, CISA is a CVE Numbering Authority (CNA), assigning CVEs, and actively maintains the Known Exploited Vulnerabilities (KEV) Catalog, which is tied to a binding operational directive (BOD) requiring federal agencies to remediate listed vulnerabilities. Other key products and services include Common Security Advisory Framework (CSAF) repositories, ICS Advisories, and Stakeholder Specific Vulnerability Categorization (SSVC) scoring for every new CVE, with retroactive scoring for approximately 140,000 to 160,000 CVEs.

The genesis of Vulnrichment stems from a critical observation: while CISA's mandated work produces a vast amount of high-quality vulnerability analysis, much of it was not previously provided publicly. The speakers highlighted the imperative to democratize this data, making it consumable for all defenders and ensuring efficient use of public funds. Vulnrichment, launched approximately a year and a half prior to the talk, emerged as CISA's answer to this challenge, serving as a platform to systematically inject this valuable analysis back into the public CVE record.

Unlike the KEV catalog, which is a "fixed structure" requiring "careful decisions to change," Vulnrichment was explicitly designed as a "playground" for experimentation. This allows CISA to "test in production" and explore what data is most useful, what takes the most analyst time to produce, and whether that information is effectively used by consumers. This cost-benefit analysis approach is crucial for optimizing CISA's investment in vulnerability analysis. A prime example of this iterative process is the decision to cease providing Common Platform Enumeration (CPE) identifiers. Initially, CPEs took analysts "two-thirds of their analysis time" but consistently received feedback from stakeholders that they were "not that useful." By eliminating CPEs, CISA was able to expand its "aperture for doing further vulnerability enrichment" and apply SSVC and other valuable data to "essentially every new CVE." This demonstrates a commitment to agile, feedback-driven program evolution, with potential future adjustments, such as reconsidering CVSS assessments for Linux kernel vulnerabilities, as discussed in GitHub issue 262. Looking ahead, Cerkovnik expressed particular interest in exploring ways to represent CVE relationships, an area currently handled inadequately within descriptive text fields.

Key Findings

▶ Watch: Vulnrichment as a 'playground' for experimentation (7:00)

The "Vulnrichment Playground" talk underscored several critical findings regarding the evolution of vulnerability intelligence and CISA's role in shaping it. Foremost among these is the successful democratization of CISA's extensive vulnerability analysis. By actively pushing detailed analysis, such as SSVC scores and KEV status, into the public domain via the CVE ADP container and a dedicated GitHub repository, CISA has transformed a resource previously available primarily to federal agencies into a global asset for defenders. This initiative directly addresses the challenge of leveraging taxpayer-funded analysis for broader public benefit.

A significant finding is the efficacy of the "playground" approach itself. By intentionally designating Vulnrichment as an experimental platform, CISA gains the agility to rapidly iterate and refine its methodology for vulnerability data enrichment. This flexibility stands in stark contrast to more rigid, mandate-driven programs like the KEV catalog. The ability to "test in production" allows CISA to make data-driven decisions about what information is truly valuable and where to best allocate analytical resources.

The talk provided a clear example of this agility through the decision to discontinue the provision of CPEs within Vulnrichment. This move was a direct result of community feedback indicating that CPEs were not highly useful to consumers, despite consuming "two-thirds of [analyst] time." This finding demonstrates CISA's responsiveness to stakeholder needs and its commitment to optimizing resource allocation towards more impactful enrichment, such as expanding SSVC coverage. This responsiveness fosters trust and ensures the delivered data is genuinely valuable.

Furthermore, the detailed walkthrough of CVE-2023-38038 (Pandoc) illustrated that CVE records are dynamic and evolve significantly over time with the addition of more accurate and comprehensive information. Initial, minimal records are progressively enhanced with problem types, CVSS scores, SSVC assessments, corrected references, and refined descriptions, often through CISA's firsthand analysis and engagement with maintainers. This highlights that the initial CVE publication is merely a starting point, and continuous enrichment is vital for a complete picture.

Finally, the experimentation within Vulnrichment has identified critical gaps in the current CVE schema and ecosystem. The need for a standardized way to indicate broken references (leading to a temporary "hack" using not applicable:// protocol) and, more fundamentally, a machine-readable representation of CVE relationships, are clear findings. These insights pave the way for future schema improvements, demonstrating Vulnrichment's role not just in data provision, but also in driving broader advancements within the CVE program.

Technical Deep Dive

▶ Watch: Experimenting with CVE description and reference updates (18:00)

The technical core of Vulnrichment lies in its systematic approach to enhancing CVE records. Mechanically, the process is designed to be straightforward: upon the publication of a new CVE record, Vulnrichment automatically detects it and proceeds to enrich it with additional data. This enriched information is then made available through two primary interfaces: a dedicated GitHub repository and, crucially, as an ADP (Advisory Data Platform) container within the CVE record itself. This integration ensures that consumers can access the CISA-provided analysis directly alongside the original CVE data.

Key data points that Vulnrichment adds include Problem Type, CVSS (Common Vulnerability Scoring System) scores, and SSVC (Stakeholder Specific Vulnerability Categorization) decisions. SSVC is a particularly significant contribution, as CISA provides initial SSVC scoring for every new CVE and has retroactively applied it to an impressive 140,000 to 160,000 existing CVEs. The SSVC framework uses a simplified impact metric (total, partial, none) to guide prioritization, offering a more nuanced view than CVSS alone.

The speakers used CVE-2023-38038, an issue in the Pandoc document converter, as a detailed case study to illustrate Vulnrichment's impact. This CVE initially had a minimal record: a basic description, "NA" in the affected array (a placeholder indicating unknown affected versions), and some technically incorrect references. Vulnrichment's process immediately began to enhance this record:

1. Initial Enrichment: Problem Type, CVSS, and SSVC data were added on the same day the CNA container was published.
2. Reference Correction: Months later, as CISA's analysis progressed, incorrect references were updated to pandoc.org, and a specific product tag was added.
3. SSVC Revision: An initial error where the SSVC technical impact was incorrectly set to "total" was later corrected to "partial," demonstrating the iterative refinement possible within the playground.
4. Schema Experimentation: A notable "hack" was implemented to address broken references. Since the CVE schema lacks a clear way to indicate an invalid or non-functional link, Vulnrichment prefixed such URLs with not applicable:// and used a not applicable tag. This temporary solution highlights a structural gap in the current CVE data model and serves as an experiment to gauge the utility of such an indicator.
5. Description Rewrite: In a deviation from its normal scope, Vulnrichment performed a complete rewrite of the CVE description. This was possible due to CISA's "absolute firsthand knowledge and analysis" of the Pandoc vulnerability, including extensive testing with different flags and engagement with the maintainers. This enhanced description provided much clearer context on the vulnerability, which involved Server-Side Request Forgery (SSRF) to potentially grab AWS IMDS (Instance Metadata Service) v1 tokens when Pandoc was run as a web application. The CNA container later merged this improved description.

Despite these enhancements, the Pandoc case study also exposed lingering challenges. The "NA" problem in affected software versions remains, highlighting the difficulty in systematically identifying all vulnerable components. More critically, the talk emphasized the lack of a machine-readable way to represent CVE relationships. For CVE-2023-38038, Pandoc's use of external libraries for certain conversions meant that its configuration could enable other SSRF vulnerabilities, a complex relationship currently relegated to a single sentence in the description. The speakers posed the question: "Can the machine understand that? Can we scale that?"

Art Manion briefly touched upon Supplier ADP (SADP), a related concept within the CVE program. SADP allows a product owner or CNA to add their own ADP container to a CVE record, stating how a vulnerability specifically affects their product (e.g., "artebsite.com not vulnerable because we don't call it in the unsafe manner"). This mechanism provides granular, product-specific context that complements the general enrichment provided by CISA.

Finally, the talk touched upon definitional debates, asking: "Is retrieving untrusted content from the internet a vulnerability? Is it if it's well documented? Is it if it's by accident?" These fundamental questions underscore the complexity of vulnerability classification. The speakers also raised the challenge of handling conflicting information or disputes within CVE records, suggesting a need for better mechanisms to capture the nature and resolution status of such disagreements, potentially through future Vulnrichment experiments before wider schema changes.

Demo / Proof of Concept

▶ Watch: Future: capturing CVE relationships and dispute information (23:00)

While not a live demonstration in the traditional sense, the speakers provided a detailed walkthrough of how Vulnrichment has evolved the CVE record for CVE-2023-38038, an SSRF vulnerability in the Pandoc document converter. This served as a comprehensive "proof of concept" for the Vulnrichment program's capabilities and its iterative impact on vulnerability intelligence.

The demonstration meticulously charted the transformation of the Pandoc CVE from its initial, sparse state – with a minimal description, "NA" in the affected array, and incorrect references – to a significantly enriched record. This included the mechanical addition of Problem Type, CVSS, and SSVC data by Vulnrichment, followed by more complex interventions such as correcting references (e.g., from pandock.com to pandock.org), revising SSVC impact scores (from "total" to "partial"), and even a complete rewrite of the description based on CISA's firsthand analysis and testing. The speakers highlighted the pragmatic "hack" used to indicate broken references with a not applicable:// prefix, showcasing how Vulnrichment experiments with solutions to current schema limitations.

This case study effectively illustrated how CISA's operational analysis, stemming from its Known Exploited Vulnerabilities (KEV) Catalog work and engagement with maintainers, directly translates into actionable improvements in public CVE data. It served as a clear example of Vulnrichment's ability to provide deeper context, correct inaccuracies, and identify broader systemic issues within the vulnerability ecosystem, such as the challenge of representing complex CVE relationships in a machine-readable format.

Defensive Implications

▶ Watch: Q&A: industry rescoring and CVSS for prioritization (32:00)

The "Vulnrichment Playground" talk provides several critical implications for defenders seeking to enhance their vulnerability management programs and improve their overall security posture.

1. Integrate Enriched Data for Prioritization: Defenders should move beyond relying solely on CVSS scores for vulnerability prioritization. CISA's experience with FSEB agencies indicates that CVSS alone often leads to "dissonance" in prioritization. Instead, leverage the richer context provided by Vulnrichment, specifically the SSVC (Stakeholder Specific Vulnerability Categorization) scores and KEV (Known Exploited Vulnerabilities) Catalog status. SSVC offers a decision-tree-based approach that helps organizations prioritize vulnerabilities based on their specific context and risk tolerance, while KEV status provides an immediate signal of active exploitation. This data is available via the CVE ADP container or the Vulnrichment GitHub repository.

1. Actively Utilize the CVE ADP Container: As the primary intended delivery mechanism for Vulnrichment data, defenders should ensure their vulnerability management tools and processes are configured to consume information directly from the CVE ADP container. This approach provides a more efficient and comprehensive way to gather all available vulnerability intelligence in one consolidated record, reducing the need to cross-reference multiple data sources.

1. Engage with the Vulnrichment GitHub Repository: The public GitHub repository is not merely a data source but also a forum for transparency and feedback. Defenders are encouraged to engage with the Vulnrichment team by filing issues if they find inaccuracies, have suggestions for new enrichment, or disagree with current assessments (e.g., GitHub issue 262 regarding Linux kernel CVSS). This participation directly influences the program's evolution and ensures the data remains relevant and accurate for the broader community.

1. Understand and Advocate for Schema Improvements: The talk highlighted limitations in the current CVE schema, such as the inability to formally indicate broken references or, more significantly, to represent CVE relationships in a machine-readable format. Defenders should be aware of these limitations and, where possible, advocate for or participate in working groups focused on schema improvements. Better structured data will ultimately lead to more automated and precise vulnerability analysis.

1. Consider Implementing Supplier ADP: For organizations that develop and supply software, the concept of Supplier ADP (SADP) offers a powerful way to provide product-specific context for vulnerabilities. By adding an ADP container to a CVE record, a supplier can clarify whether their specific implementation of a vulnerable component is affected (e.g., "not vulnerable because we don't call it in the unsafe manner"). This proactive communication can significantly reduce the burden on downstream consumers, who might otherwise have to perform extensive analysis to determine their exposure.

1. Recognize the Dynamic Nature of CVE Records: The Pandoc case study (CVE-2023-38038) demonstrated that CVE records are not static; they evolve over time with new information, corrections, and deeper analysis. Defenders should integrate processes that allow for continuous ingestion and re-evaluation of vulnerability data, ensuring their understanding of a threat is based on the most current and enriched information available.

By adopting these defensive implications, organizations can move towards a more mature, data-driven approach to vulnerability management, leveraging CISA's extensive analysis to make more informed and efficient risk decisions.

Key Takeaways

• Democratization of Analysis: Vulnrichment successfully democratizes CISA's extensive, taxpayer-funded vulnerability analysis, making crucial insights from thousands of cases publicly available through the CVE ADP container and a GitHub repository.
• Agile Experimentation: The "playground" model allows CISA to experiment with vulnerability data enrichment, enabling rapid iteration and data-driven decisions on what information is most useful and how to best allocate analytical resources.
• Community-Driven Improvement: Feedback from the public is critical; CISA's decision to discontinue CPEs (which consumed "two-thirds of their analysis time") in favor of more impactful enrichment like SSVC demonstrates responsiveness and efficient resource allocation.
• Dynamic CVE Records: CVE records are not static but evolve over time with continuous enrichment, as exemplified by the detailed transformation of CVE-2023-38038 (Pandoc) from a minimal entry to a highly contextualized record.
• Enhanced Prioritization for Defenders: Defenders should integrate Vulnrichment data, particularly SSVC scores and KEV status, to move beyond solely CVSS-based prioritization for a more accurate and risk-contextualized approach to vulnerability management.
• Future Schema Advancements: Vulnrichment's experiments highlight key gaps in the current CVE schema, such as the need for machine-readable CVE relationships and better mechanisms for indicating broken references or capturing dispute details, paving the way for future program improvements.

About the Speaker(s)

Lindsey Cerkovnik serves as the Chief of Vulnerability Response and Coordination at CISA. In this pivotal role, she oversees a broad spectrum of operational activities related to vulnerability analysis, including managing thousands of Coordinated Vulnerability Disclosure (CVD) cases annually and coordinating the disclosure of over 2,000 CVEs in FY25. She is also responsible for the Known Exploited Vulnerabilities (KEV) Catalog and plays a key role in CISA's efforts to protect federal civilian executive branch (FSEB) agencies and critical infrastructure. Cerkovnik is a strong advocate for the efficient use of public funds and the democratization of CISA's extensive vulnerability analysis to benefit the broader cybersecurity community.

Art Manion is associated with Tharros Labs, a government contractor that provides critical support to CISA, specifically within Lindsey Cerkovnik's area of vulnerability response and coordination. His work involves supporting CISA's various vulnerability analysis initiatives, including the development and ongoing experimentation of the Vulnrichment program. Manion's expertise contributes to the technical implementation and strategic direction of how CISA's insights are integrated into public vulnerability records.