fortify-exploitability-analysis

VEX analysis determines if a CVE in a dependency is actually exploitable by tracing attacker-controlled input to the vulnerable code path. It requires a functioning package manager and CVE sources to enumerate paths and assess reachability across dependencies.

Generating a CycloneDX VEX JSON report involves assessing CVE reachability across dependencies and emitting a machine-readable artifact detailing findings, evidence, and recommended actions. This output enables integration with downstream tools like Dependency-Track and GitLab Vulnerability Management.

Reachability analysis works across ecosystems including Maven, Gradle, npm, Python, and Go. It enumerates dependency paths and performs per-path assessment to determine if vulnerable code is actually reachable within each specific environment context.

To start assessing CVE exploitability, you need to provide the CVE or GHSA identifier and the project root directory. The environment must have a functioning package manager and CVE sources to enumerate paths and produce the impact report and VEX outputs.

Suppressing false positive vulnerabilities uses the evidence trail from reachability analysis demonstrating that attacker-controlled input cannot reach the vulnerable code path. The generated Markdown impact report and CycloneDX VEX JSON provide the structured verdict needed for FoD or SSC suppressions.

The best way to triage known CVE and GHSA vulnerabilities in transitive dependencies is tracing attacker-controlled input paths to the vulnerable code. This disciplined workflow produces a structured verdict and actionable guidance, differentiating actual threats from unreachable code.