VB002: No exploit from the heavens¶
A vulnerability report can be safely dismissed if it describes a severe end state, but only under attacker capability assumptions that are more powerful than the vulnerability itself.
Alternatively: a vulnerability report can be safely dismissed if it implies that the attacker is already more powerful than the attack's outcome would grant.
Examples¶
-
A report for content manipulation on a web service, where the manipulation can only occur if the attacker is an active meddler in the middle. No vulnerability exists here, because an active MiTM could send entirely arbitrary content, and would not have to limit themselves to manipulating pre-existing content.
-
A report for code execution via memory corruption in CPython, where the memory corruption occurs by directly manipulating CPython's object internals at runtime (via ctypes, for example). No vulnerability exists here, because the attacker is already running arbitrary code to perform the corruption.