<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-template-severity-classification
description: >-
  Implement consistent severity classification in Nuclei templates using
  CVSS scoring, CWE mapping, business impact assessment, and multi-factor
  severity logic. Covers severity levels, dynamic severity with DSL,
  conditional severity based on findings, and organizational risk mapping.
domain: cybersecurity
subdomain: nuclei-templating
tags:
  - nuclei
  - severity
  - classification
  - cvss
  - cwe
  - risk-assessment
  - templates
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Implementing Template Severity Classification

## Overview

Severity classification determines how findings are prioritized in scan
results. Consistent severity assignment using CVSS vectors, CWE mappings,
and contextual factors ensures that security teams can triage effectively.
Nuclei supports static severity levels and dynamic classification through
DSL-based extractors that adjust severity based on what the template finds.

Mode: `[MODE: BLUE]` — Vulnerability classification and triage accuracy.

## Prerequisites

| Requirement | Details |
|---|---|
| Nuclei v3+ (`nuclei -version`) | Required |
| Understanding of CVSS v3.1 scoring methodology | Required |
| Familiarity with CWE taxonomy | Required |

## Key Concepts

### Full Classification Block

```yaml
id: full-classification-example

info:
  name: SQL Injection — Union-Based Detection
  author: nerf
  severity: critical
  description: |
    Detects union-based SQL injection vulnerabilities that allow
    attackers to extract data from the database. Classified as
    critical due to direct data breach impact.
  impact: |
    Full database read access. Potential for data exfiltration,
    credential theft, and lateral movement to backend systems.
  remediation: |
    Use parameterized queries or prepared statements. Implement
    input validation and WAF rules as defense in depth.
  reference:
    - https://owasp.org/www-community/attacks/SQL_Injection
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: ""
    cwe-id: CWE-89
  tags: sqli,injection,critical,owasp-top10
  metadata:
    max-request: 1
    verified: true

http:
  - method: GET
    path:
      - "{{BaseURL}}/search?q=1'+UNION+SELECT+NULL,NULL--"
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "UNION"
          - "SELECT"
        condition: and
      - type: status
        status:
          - 200
```

### Severity Levels with Examples

```yaml
id: severity-info-technology-detection

info:
  name: Technology Stack Detection
  author: nerf
  severity: info
  description: Identifies web server technology and version.
  classification:
    cwe-id: CWE-200
  tags: tech,detection,recon
  metadata:
    max-request: 1

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers:
      - type: regex
        part: header
        regex:
          - '(?i)server:\s*(.+)'
    extractors:
      - type: kval
        kval:
          - server
          - x-powered-by
```

```yaml
id: severity-low-directory-listing

info:
  name: Directory Listing Enabled
  author: nerf
  severity: low
  description: |
    Web server directory listing is enabled, exposing file names
    and directory structure to unauthorized users.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cwe-id: CWE-548
  tags: misconfig,listing,exposure
  metadata:
    max-request: 1

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Index of /"
          - "Parent Directory"
        condition: and
      - type: status
        status:
          - 200
```

```yaml
id: severity-medium-cors-misconfig

info:
  name: Permissive CORS Configuration
  author: nerf
  severity: medium
  description: |
    Application reflects arbitrary Origin header in
    Access-Control-Allow-Origin response with credentials allowed.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
    cvss-score: 7.1
    cwe-id: CWE-942
  tags: cors,misconfig,header
  metadata:
    max-request: 1

http:
  - raw:
      - |
        GET {{BaseURL}}/ HTTP/1.1
        Host: {{Hostname}}
        Origin: https://evil.com

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "Access-Control-Allow-Origin: https://evil.com"
          - "Access-Control-Allow-Credentials: true"
        condition: and
      - type: status
        status:
          - 200
```

```yaml
id: severity-high-ssrf-detection

info:
  name: Server-Side Request Forgery Detection
  author: nerf
  severity: high
  description: |
    Detects SSRF vulnerabilities allowing internal network access.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cwe-id: CWE-918
  tags: ssrf,owasp-top10,high
  metadata:
    max-request: 1

http:
  - method: GET
    path:
      - "{{BaseURL}}/fetch?url=http://169.254.169.254/"
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "meta-data"
          - "ami-id"
        condition: or
      - type: status
        status:
          - 200
```

## Workflow

### Step 1: Assess CVSS Vector

Calculate the CVSS v3.1 vector based on attack characteristics:
- Attack Vector, Complexity, Privileges Required, User Interaction
- Scope, Confidentiality, Integrity, Availability impact

### Step 2: Map CWE

Identify the root weakness class from the CWE taxonomy and include
it in the classification block.

### Step 3: Validate Template

```bash
node scripts/agent.js --action validate --template template.yaml
```

### Step 4: Scan and Review Classification

```bash
node scripts/agent.js --action scan --target https://target.com \
  --template template.yaml --output /tmp/classified-scan.json
```

## Verification

- [ ] Severity matches CVSS score range (critical: 9.0+, high: 7.0+, medium: 4.0+, low: 0.1+)
- [ ] CVSS vector string is valid and matches score
- [ ] CWE-ID accurately describes the weakness class
- [ ] `impact` and `remediation` fields provide actionable context
- [ ] Tags include severity level for filtering
- [ ] Templates tested against real targets to confirm severity accuracy

## References

- [CVSS v3.1 Specification](https://www.first.org/cvss/v3.1/specification-document)
- [CWE Top 25 Most Dangerous](https://cwe.mitre.org/top25/archive/2023/2023_top25_list.html)
- [Nuclei Severity Levels](https://docs.projectdiscovery.io/templates/reference/template-structure)
- [OWASP Risk Rating Methodology](https://owasp.org/www-community/OWASP_Risk_Rating_Methodology)
