<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-cve-exploit-chains
description: >-
  Analyze CVE exploit chains to identify multi-step attack paths where
  individual vulnerabilities combine into critical exploitation sequences,
  mapping dependencies and assessing compound risk.
domain: cybersecurity
subdomain: vulnerability-management
tags:
  - cve-analysis
  - exploit-chains
  - attack-paths
  - nvd
  - vulnerability-chaining
  - mitre-attack
  - compound-risk
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078.004", "T1190", "T1552.005"]
---

# Analyzing CVE Exploit Chains

## Overview

Individual vulnerabilities rated medium or high can combine into critical exploit
chains — an SSRF enabling access to IMDS leading to credential theft leading to
lateral movement. This skill covers identifying chainable CVEs, mapping exploitation
dependencies, assessing compound risk scores, and prioritizing chains over individual
findings.

Mode: `[MODE: RED]` — Offensive analysis of exploit chain viability.

## Prerequisites

- NVD API access (api key recommended for rate limits)
- Exploit-DB and GitHub Advisory database access
- Python 3.10+ with `requests`
- MITRE ATT&CK Navigator for chain visualization

## Key Concepts

### Exploit Chain Taxonomy

| Chain Type | Example | Combined Impact |
|-----------|---------|-----------------|
| Initial Access → Privilege Escalation | SQLi → kernel privesc | Medium + High = Critical |
| SSRF → Cloud Metadata | SSRF → IMDS v1 credential theft | Medium → Critical |
| Auth Bypass → RCE | Broken auth → command injection | High + High = Critical |
| Info Disclosure → Account Takeover | Path traversal → config leak → cred reuse | Low + Medium = High |
| Supply Chain → Lateral | Dependency confusion → internal pivoting | Medium → Critical |

### NVD CVE Analysis

```bash
# Get CVE details with references
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-6387" \
  -H "apiKey: $NVD_API_KEY" | jq '.vulnerabilities[0].cve'

# Search CVEs by CWE (find related vulnerability classes)
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cweId=CWE-918&resultsPerPage=20" \
  -H "apiKey: $NVD_API_KEY" | jq '.vulnerabilities[].cve.id'

# Search by keyword for chainable vulns
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=ssrf+metadata&resultsPerPage=10" \
  -H "apiKey: $NVD_API_KEY" | jq '.vulnerabilities[].cve.id'
```

### Chain Dependency Mapping

```
Chain: SSRF → IMDS → IAM Credential Theft

Step 1: CVE-2021-26855 (ProxyLogon SSRF)
  ├── CWE: CWE-918 (Server-Side Request Forgery)
  ├── Prerequisite: Network access to Exchange
  ├── Provides: Arbitrary internal HTTP requests
  └── ATT&CK: T1190 (Exploit Public-Facing Application)

Step 2: IMDS v1 Access (no CVE — misconfiguration)
  ├── CWE: CWE-284 (Improper Access Control)
  ├── Prerequisite: SSRF capability + EC2 instance
  ├── Provides: IAM temporary credentials
  └── ATT&CK: T1552.005 (Cloud Instance Metadata API)

Step 3: Credential Abuse
  ├── Prerequisite: Valid IAM credentials
  ├── Provides: AWS API access with role permissions
  └── ATT&CK: T1078.004 (Valid Accounts: Cloud Accounts)

Compound CVSS: Individual 9.1 + config → Chain = 10.0 (full compromise)
```

### Exploit-DB Cross-Reference

```bash
# Search for public exploits
searchsploit "CVE-2024-6387"
searchsploit --json "openssh" | jq '.RESULTS_EXPLOIT[] | {Title, Path}'

# Check GitHub for PoC availability
curl -s "https://api.github.com/search/repositories?q=CVE-2024-6387+poc" | \
  jq '.items[:5] | .[] | {name: .full_name, stars: .stargazers_count, url: .html_url}'
```

## Workflow

### Step 1: Identify Chainable CVEs

```bash
node scripts/agent.js --action identify-chains \
  --input /tmp/scan_results.json \
  --output /tmp/exploit_chains.json
```

### Step 2: Map Chain Dependencies

```bash
node scripts/agent.js --action map-chain \
  --cves CVE-2021-26855,CVE-2024-6387 \
  --output /tmp/chain_analysis.json
```

### Step 3: Score Compound Risk

```bash
node scripts/agent.js --action score \
  --input /tmp/exploit_chains.json \
  --output /tmp/chain_scores.json
```

## Detection

```yaml
title: Cve Exploit Chains Detection
id: 054680bc-0e3e-4f62-8d7e-3630af4ba5ba
status: experimental
description: Detects suspicious activity related to analyzing cve exploit chains techniques in vulnerability management context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*analyzing*cve*"
  condition: selection
level: medium
tags:
  - attack.t1078.004
  - attack.t1190
  - attack.t1552.005
  - attack.discovery
falsepositives:
  - Vulnerability scanner performing scheduled assessment scans
```

## Verification

- [ ] All critical/high CVEs assessed for chaining potential
- [ ] Exploit chain dependencies documented with ATT&CK mapping
- [ ] Compound risk scores calculated and prioritized
- [ ] Public exploit availability checked (Exploit-DB, GitHub, PacketStorm)
- [ ] Chain-breaking mitigations identified for each step
- [ ] Detection opportunities mapped for each chain link

## References

- [NVD API Documentation](https://nvd.nist.gov/developers/vulnerabilities)
- [MITRE ATT&CK — Technique Matrix](https://attack.mitre.org/matrices/enterprise/)
- [Exploit-DB](https://www.exploit-db.com/)
- [FIRST CVSS v4.0 Specification](https://www.first.org/cvss/v4.0/specification-document)
