Supported CVEs for reachability analysis

Fluid Attacks informs of reachability status at the following levels:

1. Latent: (a) A vulnerable dependency is declared in the package manager, but (b) no file imports the dependency.
2. Potential: (a) A vulnerable dependency is declared in the package manager, (b) the vulnerable dependency is imported in the code, but (c) the vulnerable function in the dependency is not called from the code.
3. Reachable: (a) A vulnerable dependency is declared in the package manager, (b) the vulnerable dependency is imported in the code, and (c) the vulnerable function in the dependency is called from the code.

Below are two technical examples and an analogy for better comprehension:

Example 1 in JS (Node.js)

Example 2 in Python

Analogy

Example 1 in JS (Node.js)

package.json

{  "name": "demo-app",  "version": "1.0.0",  "dependencies": {    "vulnLib": "1.2.3"  }}

app.js

*// LATENT: Library declared in package.json but not imported nor used* console.log("Hello world"); *// POTENTIAL: Library imported but vulnerable function not used* import vulnLib from 'vulnLib', console.log("Library loaded but dangerous function not used") *// REACHABLE: Library imported and vulnerable function is used* import vulnLib from 'vulnLib', vulnLib.dangerousFunction(); *// <- Risk activated*

// REACHABLE: Library imported and vulnerable function is used

Example 2 in Python

requirements.txt

vuln-lib==1.2.3

app.py

*# LATENT: Library declared in requirements.txt but not imported nor used* print("Hello world") *# POTENTIAL: Library imported but vulnerable function not used* import vuln_lib print("Library loaded but dangerous function not used") *# REACHABLE: Library imported and vulnerable function is used* import vuln_lib vuln_lib.dangerousFunction() *# <- Risk activated*

// REACHABLE: Library imported and vulnerable function is used

Analogy

1. Latent
2. The book is in the library (declared), but
3. you do not read any chapter (not imported).
4. Potential
5. The book is in the library (declared),
6. you start reading any chapter (imported), but
7. you do not read the faulty chapter.
8. Reachable
9. The book is in the library (declared),
10. you start reading any chapter (imported), and
11. you read the faulty chapter and use it as a reference for your MBA thesis.