redink/sections/14-per-finding-details/schema.json at main · AnshumanAtrey/redink · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://github.com/AnshumanAtrey/redink/sections/14-per-finding-details/schema.json",
  "title": "Universal Per-Finding Schema",
  "description": "Universal schema used as the base by every framework. Frameworks may overlay additional fields via frameworks/<name>/schema-overlay.json.",
  "type": "object",
  "required": [
    "s_no",
    "name_of_vulnerability",
    "severity",
    "vulnerable_location",
    "vulnerable_path_port_url",
    "vulnerable_parameter",
    "cve_cwe",
    "cvss_epss_score",
    "description",
    "poc_intro",
    "poc_steps",
    "recommendations",
    "references",
    "additional_observations",
    "cwe_cve_audit",
    "cvss_audit"
  ],
  "properties": {
    "s_no": {
      "type": "string",
      "description": "Serial number. Format varies by framework: '001' (CERT-In), 'FINDING-001' (OWASP OPTRS), 'F-001' (CMMC), 'CHK-001' (CHECK), 'PCI-001' (PCI DSS)."
    },
    "name_of_vulnerability": {
      "type": "string",
      "description": "Verbatim from the poc/<scope>/<folder>/ folder name. Typos, spaces, mixed case preserved.",
      "minLength": 1
    },
    "severity": {
      "type": "string",
      "enum": ["Critical", "High", "Medium", "Low", "Informational", "N/A"]
    },
    "vulnerable_location": {
      "type": "string",
      "description": "Host + service descriptor. e.g. '<host> @ <ip> — Apache Tomcat web UI'."
    },
    "vulnerable_path_port_url": {
      "type": "string",
      "description": "Exact URL/port/path. e.g. 'http://<ip>:8080/' or 'tcp/22 (SSH)'."
    },
    "vulnerable_parameter": {
      "type": ["string", "null"]
    },
    "cve_cwe": {
      "type": "string",
      "description": "Comma-separated CWE-N and/or CVE-YYYY-NNNNN."
    },
    "cvss_epss_score": {
      "type": "string",
      "description": "CVSS v3.1 vector + base + severity, optionally EPSS + lookup date."
    },
    "description": {"type": "string", "maxLength": 600},
    "poc_intro": {"type": ["string", "null"]},
    "poc_steps": {
      "type": "array",
      "minItems": 1,
      "items": {
        "type": "object",
        "required": ["step_number", "caption", "image_path"],
        "properties": {
          "step_number": {"type": "integer", "minimum": 1},
          "caption": {"type": "string", "maxLength": 200},
          "image_path": {"type": "string"}
        }
      }
    },
    "recommendations": {
      "type": "array",
      "minItems": 2,
      "maxItems": 4,
      "items": {"type": "string", "maxLength": 200}
    },
    "references": {"type": "string"},
    "additional_observations": {"type": ["string", "null"]},
    "cwe_cve_audit": {"type": "string"},
    "cvss_audit": {"type": "string"}
  }
}