Vulnerability Pattern Matcher

Vulnerability Pattern Matcher

Overview

This skill detects security vulnerabilities by matching code against a comprehensive database of known vulnerability patterns, insecure coding idioms, and historical CVE-style patterns. It identifies risky code, explains why each pattern is dangerous, assesses exploitability conditions, and provides severity ratings with confidence levels.

Detection Workflow

Follow these steps to detect and assess vulnerabilities:

1. Analyze Code Structure

Identify key security-relevant elements:

• User input sources (request parameters, form data, file uploads)
• Data sinks (database queries, file operations, command execution)
• Authentication and authorization mechanisms
• Cryptographic operations
• Network communications
• File and resource handling

Map data flow:

• Trace user input through the application
• Identify where untrusted data reaches sensitive operations
• Note any validation or sanitization applied

2. Match Vulnerability Patterns

Scan for known patterns:

• Injection vulnerabilities (SQL, NoSQL, LDAP, XSS, command injection)
• Authentication issues (hardcoded credentials, weak session management)
• Cryptographic failures (weak algorithms, insecure random numbers)
• Access control problems (IDOR, missing authorization)
• Deserialization vulnerabilities
• Path traversal and file inclusion
• SSRF and XXE
• Buffer overflows and memory safety
• Race conditions

For each match:

• Identify the specific pattern
• Note the exact code location
• Determine the vulnerability category

3. Assess Exploitability

For each detected vulnerability, evaluate:

Attack Complexity:

• Low: Simple exploit, no special conditions required
• Medium: Requires specific conditions, timing, or configuration
• High: Complex exploit chain, rare conditions, or significant obstacles

Privileges Required:

• None: Unauthenticated attacker can exploit
• Low: Basic user account needed
• High: Administrative or privileged access required

User Interaction:

• None: Fully automated exploit
• Required: Victim must take action (click link, open file, etc.)

Exploitation Conditions:

• What must be true for successful exploitation?
• Are there mitigating controls present?
• What is the attack surface?

4. Determine Severity

Critical:

• Remote code execution
• Authentication bypass
• Complete system compromise
• Mass data breach

High:

• Privilege escalation
• Sensitive data exposure
• SQL injection with data access
• SSRF to internal services

Medium:

• XSS with session theft
• IDOR to user data
• Information disclosure
• Weak cryptography

Low:

• Minor information leakage
• Low-impact XSS
• Configuration issues
• Verbose error messages

5. Generate Report

For each vulnerability, provide:

• Pattern name and category
• Code location (file:line)
• Why the pattern is risky
• Exploitation conditions
• Severity level
• Detection confidence (High/Medium/Low)
• Recommended fix

Detection Examples

Example 1: SQL Injection

Code (Python):

def get_user(username):
    query = "SELECT * FROM users WHERE username = '" + username + "'"
    cursor.execute(query)
    return cursor.fetchone()

Detection:

• Pattern: SQL Injection (String Concatenation)
• Location: Line 2
• Category: Injection Vulnerability

Why Risky: User input is directly concatenated into SQL query without parameterization. Attacker can inject SQL code to bypass authentication, extract data, or modify the database.

Exploitation Conditions:

• User controls username parameter
• No input validation or sanitization
• Database errors may be exposed to attacker

Severity: High Confidence: High (95%)

Recommended Fix:

def get_user(username):
    query = "SELECT * FROM users WHERE username = ?"
    cursor.execute(query, (username,))
    return cursor.fetchone()

Example 2: Hardcoded Credentials

Code (JavaScript):

const config = {
    apiKey: "sk-1234567890abcdef",
    dbPassword: "admin123",
    jwtSecret: "my-secret-key"
};

Detection:

• Pattern: Hardcoded Credentials
• Location: Lines 2-4
• Category: Authentication & Session Management

Why Risky: Credentials are embedded in source code and likely committed to version control. Anyone with repository access can authenticate as the application. Credentials are difficult to rotate if compromised.

Exploitation Conditions:

• Code repository is public or leaked
• Credentials are still valid
• No additional authentication factors

Severity: Critical Confidence: High (100%)

Recommended Fix:

const config = {
    apiKey: process.env.API_KEY,
    dbPassword: process.env.DB_PASSWORD,
    jwtSecret: process.env.JWT_SECRET
};

Example 3: XSS via innerHTML

Code (JavaScript):

function displayWelcome(username) {
    document.getElementById('welcome').innerHTML = "Hello " + username;
}

Detection:

• Pattern: DOM-based XSS
• Location: Line 2
• Category: Cross-Site Scripting

Why Risky: User-controlled data is directly inserted into DOM via innerHTML without encoding. Attacker can inject JavaScript to steal cookies, session tokens, or perform actions as the victim.

Exploitation Conditions:

• username contains user input
• No Content-Security-Policy
• Sensitive data in cookies or localStorage

Severity: Medium Confidence: High (90%)

Recommended Fix:

function displayWelcome(username) {
    document.getElementById('welcome').textContent = "Hello " + username;
}