cwssjs

Implementation of CWSS in JavaScript

Requirements

Node v. 10

Install

$ npm i cwssjs

Usage

const CWSS = require('cwssjs');

const vectorStr = "(TI:H,0.9/AP:A,1.0/AL:A,1.0/IC:N,1.0/FC:T,1.0/RP:L,0.9/RL:A,1.0/AV:I,1.0/AS:N,1.0/IN:T,0.9/SC:A,1.0/BI:C,1.0/DI:H,1.0/EX:H,1.0/EC:N,1.0/P:NA,1.0)";

const cwss_obj = CWSS.compute_vector(vectorStr);

console.log("Final Score is :" + cwss_obj.final);

Exports

compute_vector(vector, options={version: '1.0.1'})

Description

Computes a CWSS score based on the provided Vector. Note: It's important to realize that weights are NOT respected EXCEPT when using the Quantified (Q) value.

Returns

This function returns a "CWSS Object" as described below on success (and in some cases on failure, see "Notes"). This function may throw Error when content is not properly formed.

CWSS Object

CWSS Object contains several pieces of data for your consumption.

Keys | Description | Notes -----|-------------|-------------- vector | Well formed CWSS Vector String | Main contain "Error" in the case of an error vector_obj | Parsed Vector String Object | See below for format base_finding | Base Finding metric score in raw | attack_surface | Attack Surface metric score in raw | environment | Environment metric score in raw | final | Final Score at single precision (i.e. 20.1) as a string |

Vector Object

Vector Object contains the entire breakdown of the CWSS Vector string that was passed in to compute\_vector() and takes the format of:

{
    TI: { code: 'H', weight: 0.9 },
    AP: { code: 'A', weight: 1 },
    AL: { code: 'A', weight: 1 },
    IC: { code: 'N', weight: 1 },
    FC: { code: 'T', weight: 1 },
    RP: { code: 'L', weight: 0.9 },
    RL: { code: 'A', weight: 1 },
    AV: { code: 'I', weight: 1 },
    AS: { code: 'N', weight: 1 },
    IN: { code: 'T', weight: 0.9 },
    SC: { code: 'A', weight: 1 },
    BI: { code: 'C', weight: 1 },
    DI: { code: 'H', weight: 1 },
    EX: { code: 'H', weight: 1 },
    EC: { code: 'N', weight: 1 },
    P: { code: 'NA', weight: 1 }
}

Additional contents may be visible in the object. Do not rely on their existence.

Parameters

vector is expected to be a String in the format of (TI:H,0.9/AP:A,1.0/AL:A,1.0/IC:N,1.0/FC:T,1.0/RP:L,0.9/RL:A,1.0/AV:I,1.0/AS:N,1.0/IN:T,0.9/SC:A,1.0/BI:C,1.0/DI:H,1.0/EX:H,1.0/EC:N,1.0/P:NA,1.0) or an Object in the Vector Object format, mentioned above. The vector is validated against various parts of the specification, and if they are found to be non-conformant, they will be updated to be correct. If factors are missing from the vector string, they will be added with a default of Not Applicable (NA). This is NOT behavior that is defined by the standard. The corrected vector string will be provided in the return CWSS Object.

options is an optional argument that may be provided. It supports the following:

Keys | Permitted Values -----|----------------- version | - 1.0.1 : This is the latest version of CWSS at the time of writing

to_vector_str(vector, options={version: '1.0.1'})

Description

Produces a vector string formatted as per the standard.

Returns

Returns a vector string formated as per the specified version.

Parameters

vector is a vector object, as defined in compute\_vector() above.

options is an optional argument that may be provided. It supports the following:

Keys | Permitted Values -----|----------------- version | - 1.0.1 : This is the latest version of CWSS at the time of writing

References

1. Common Weakness Scoring System (CWSS) by The MITRE Corporation