vulntology-json-schema-1.0-draft.json

{
    "$schema": "http://json-schema.org/draft-07/schema#",
    "$id": "http://csrc.nist.gov/ns/vulntology/1.0",
    "type": "object",
    "title": "",
    "description": "a vulnerability entry",
    "definitions": {
        "UUID": {
            "description": "The unique identifier for my object. (A UUID specified by RFC4122).",
            "type": "string",
            "format": "uuid"
        },
        "name": {
            "description": "A 2-32 character name or label to assist humans in identifying the purpose of a given Scenario or Action object",
            "type": "string",
            "minLength": 2,
            "maxLength": 32
        },
        "SectorOfInterest": {
            "type": "string",
            "enum": [
                "Industrial Control System",
                "Health Care",
                "Finance",
                "Automotive",
                "Public Administration"
            ]
        },
        "VulnerabilityIdentifier": {
            "type": "object",
            "required": [
                "scheme",
                "value"
            ],
            "properties": {
                "scheme": {"$ref": "#/definitions/SimpleScheme"},
                "value": {"type": "string"}
            }
        },
        "Product": {
            "type": "object",
            "anyOf": [
                {
                    "required": ["hasProductEnumeration"]
                },
                {
                    "required": ["hasNvdCpeApplicabilityStatement"]
                },
                {
                    "required": ["hasCve5Product"]
                },
                {
                    "required": ["hasCve4Product"]
                }
            ],
            "properties": {
                "hasProductEnumeration": {
                    "$comment": "This is intended to be used for simple enumerations such as generic free text or common formats that identify explicit instances of products such as CPE or SWID.",
                    "type": "array",
                    "minItems": 1,
                    "items": {
                        "$ref": "#/definitions/ProductEnumeration"
                    }
                },
                "hasNvdCpeApplicabilityStatement": {"$ref": "#/definitions/NvdCpeApplicabilityStatement"},
                "hasCve5Product": {"$ref": "#/definitions/Cve5Product"},
                "hasCve4Product": {"$ref": "#/definitions/Cve4Product"}
            }
        },
        "NvdCpeApplicabilityStatement": {
            "type": "array",
            "minItems": 1,
            "items": {
                "$comment": "This is to reference the NVD configurations section, which requires much more complex JSON than simple strings. We could expand to other references or a broader structure to allow other schemas to be referenced in a generally applicable way.",
                "$ref": "https://csrc.nist.gov/schema/nvd/api/2.0/cve_api_json_2.0.schema#/definitions/config"
            }
        },
        "Cve5Product": {
            "type": "array",
            "minItems": 1,
            "items": {
                "$comment": "This is to reference the CVE Program CVE 5.0 JSON Schema's product section which can communicate vulnerable product information in various complicated ways.",
                "$ref": "https://raw.githubusercontent.com/CVEProject/cve-schema/v5.0.0/schema/v5.0/CVE_JSON_5.0_schema.json#/definitions/product"
            }
        },
        "Cve4Product": {
            "type": "array",
            "minItems": 1,
            "items": {
                "$comment": "This is to reference the CVE Program CVE 4.0 JSON Schema's affects section which can communicate vulnerable product information.",
                "$ref": "https://raw.githubusercontent.com/CVEProject/cve-schema/master/schema/v4.0/CVE_JSON_4.0_min_public.schema#definitions/affects"
            }
        },
        "ProductEnumeration": {
            "properties": {
                "scheme": {"$ref": "#/definitions/SimpleScheme"},
                "values": {
                    "type": "array",
                    "minItems": 1,
                    "uniqueItems": true,
                    "items": {"type": "string"}
                }
            },
            "required": [
                "scheme",
                "values"
            ]
        },
        "ExploitedWeakness": {
            "type": "string",
            "description": "CWE ID of the CWE that best describes the weakness used",
            "minLength": 5,
            "pattern": "^CWE-[0-9]+$"
        },
        "EngineeringMethod": {
            "type": "string",
            "enum": [
                "Malicious Application",
                "Malicious File",
                "Malicious Link",
                "Malicious Website Content"
            ]
        },
        "PrivilegeLevel": {
            "type": "string",
            "enum": [
                "Anonymous",
                "Generic Trust",
                "User",
                "Privileged",
                "Administrator"
            ]
        },
        "Context": {
            "type": "string",
            "enum": [
                "Application",
                "Application::Container",
                "Application::Database",
                "Application::Module",
                "Application::Web Server",
                "Channel",
                "Firmware",
                "Hypervisor",
                "Host OS",
                "Guest OS",
                "Physical Hardware"
            ]
        },
        "ImpactMethodType": {
            "type": "string",
            "enum": [
                "Authentication Bypass",
                "Code Execution",
                "Trust Failure",
                "Trust Failure::Failure to Establish Trust",
                "Trust Failure::Failure to Verify Content",
                "Trust Failure::Failure to Verify Receiver",
                "Trust Failure::Failure to Verify Transmitter"
            ]
        },
        "ImpactMethod": {
            "oneOf": [
                {
                    "type": "object",
                    "properties": {
                        "hasImpactMethodType": {"const": "Privilege Escalation"},
                        "hasGainedPrivilege": {"$ref": "#/definitions/PrivilegeLevel"}
                    },
                    "required": [
                        "hasImpactMethodType",
                        "hasGainedPrivilege"
                    ],
                    "additionalProperties": false
                },
                {
                    "type": "object",
                    "properties": {
                        "hasImpactMethodType": {"const": "Context Escape"},
                        "hasEscapeContext": {"$ref": "#/definitions/Context"}
                    },
                    "required": [
                        "hasImpactMethodType",
                        "hasEscapeContext"
                    ],
                    "additionalProperties": false
                },
                {
                    "type": "object",
                    "properties": {
                        "hasImpactMethodType": { "$ref": "#/definitions/ImpactMethodType"}
                    },
                    "required": [
                        "hasImpactMethodType"
                    ],
                    "additionalProperties": false
                }
            ]
        },
        "EntityRole": {
            "type": "string",
            "enum": [
                "Security Authority::Primary",
                "Security Authority::Secondary",
                "Component::Vulnerable",
                "Component::Impacted"
            ]
        },
        "Criticality": {
            "type": "string",
            "enum": [
                "Low",
                "High"
            ]
        },
        "Scope": {
            "type": "string",
            "enum": [
                "Limited",
                "Unlimited"
            ]
        },
        "LogicalImpact": {
            "type": "string",
            "enum": [
                "Indirect Disclosure",
                "Read Direct",
                "Resource Removal",
                "Service Interrupt",
                "Service Interrupt::Hang",
                "Service Interrupt::Panic",
                "Service Interrupt::Reboot",
                "Service Interrupt::Shutdown",
                "Service Interrupt::Unrecoverable",
                "Write Direct"
            ]
        },
        "PhysicalImpact": {
            "type": "string",
            "enum": [
                "Human Injury",
                "Human Injury::Negligible",
                "Human Injury::Minor",
                "Human Injury::Serious",
                "Human Injury::Critical",
                "Human Injury::Catastrophic",
                "Physical Resource Consumption",
                "Physical Resource Consumption::Assets",
                "Physical Resource Consumption::Electricity",
                "Physical Resource Consumption::Water",
                "Property Damage"
            ]
        },
        "LogicalImpactLocation": {
            "type": "string",
            "enum": [
                "File System",
                "Memory",
                "Network Traffic"
            ]
        },
        "Impact": {
            "type": "object",
            "oneOf": [
                {
                    "properties": {
                        "id": {"$ref": "#/definitions/UUID"},
                        "hasCriticality": {"$ref": "#/definitions/Criticality"},
                        "hasScope": {"$ref": "#/definitions/Scope"},
                        "hasLogicalImpact": {"$ref": "#/definitions/LogicalImpact"},
                        "hasLocation": {"$ref": "#/definitions/LogicalImpactLocation"}
                    },
                    "required": [
                        "id",
                        "hasLogicalImpact",
                        "hasScope",
                        "hasCriticality"
                    ],
                    "additionalProperties": false
                },
                {
                    "properties": {
                        "id": {"$ref": "#/definitions/UUID"},
                        "hasCriticality": {"$ref": "#/definitions/Criticality"},
                        "hasScope": {"$ref": "#/definitions/Scope"},
                        "hasPhysicalImpact": {"$ref": "#/definitions/PhysicalImpact"}
                    },
                    "required": [
                        "id",
                        "hasPhysicalImpact",
                        "hasScope",
                        "hasCriticality"
                    ],
                    "additionalProperties": false
                }
            ]
        },
        "Barrier": {
            "type": "object",
            "oneOf": [
                {
                    "properties": {
                        "id": {"$ref": "#/definitions/UUID"},
                        "hasBarrierType": {"const": "Authentication/Authorization::Privileges Required"},
                        "hasNeededPrivilege": {"$ref": "#/definitions/PrivilegeLevel"},
                        "relatesToContext": {"$ref": "#/definitions/Context"}
                    },
                    "required": [
                        "id",
                        "hasBarrierType",
                        "hasNeededPrivilege"
                    ]
                },
                {
                    "properties": {
                        "id": {"$ref": "#/definitions/UUID"},
                        "hasBarrierType": {"const": "Authentication/Authorization::Impersonation::Social Engineering"},
                        "hasEngineeringMethod": {
                            "type": "array",
                            "minItems": 1,
                            "items": {"$ref": "#/definitions/EngineeringMethod"}
                        },
                        "hasNeededPrivilege": {"$ref": "#/definitions/PrivilegeLevel"},
                        "relatesToContext": {"$ref": "#/definitions/Context"}
                    },
                    "required": [
                        "id",
                        "hasBarrierType",
                        "hasEngineeringMethod"
                    ]
                },
                {
                    "properties": {
                        "id": {"$ref": "#/definitions/UUID"},
                        "hasBarrierType": {
                            "oneOf": [
                                {"const": "Boundary Protections"},
                                {"const": "Boundary Protections::Container"},
                                {"const": "Boundary Protections::Sandbox"}
                            ]
                        },
                        "relatesToContext": {"$ref": "#/definitions/Context"}
                    },
                    "required": [
                        "id",
                        "hasBarrierType",
                        "relatesToContext"
                    ]
                },
                {
                    "properties": {
                        "id": {"$ref": "#/definitions/UUID"},
                        "hasBarrierType": {
                            "type": "string",
                            "enum": [
                                "Obfuscation",
                                "Obfuscation::ASLR",
                                "Obfuscation::Dynamic Compilation",
                                "State",
                                "State::Race Condition",
                                "State::Race Condition::No Control",
                                "State::Race Condition::Partial Control",
                                "State::Race Condition::Full Control",
                                "State::Specialized Condition",
                                "State::Environmental Condition",
                                "State::Precondition Required",
                                "Authentication/Authorization",
                                "Authentication/Authorization::Impersonation",
                                "Authentication/Authorization::Encryption",
                                "Authentication/Authorization::Impersonation::On Path"
                            ]
                        }
                    },
                    "required": [
                        "id",
                        "hasBarrierType"
                    ]
                }
            ]
        },
        "Action": {
            "type": "object",
            "required": [
                "id",
                "hasImpactMethod",
                "affectsContext",
                "hasEntityRole",
                "resultsInImpact"
            ],
            "properties": {
                "id": {"$ref": "#/definitions/UUID"},
                "hasImpactMethod": {
                    "type": "array",
                    "minItems": 1,
                    "items": {"$ref": "#/definitions/ImpactMethod"}
                },
                "affectsContext": {"$ref": "#/definitions/Context"},
                "hasEntityRole": {"$ref": "#/definitions/EntityRole"},
                "resultsInImpact": {
                    "type": "array",
                    "minItems": 1,
                    "items": {"$ref": "#/definitions/Impact"}
                },
                "doesNotResultInImpact": {
                    "$comment": "While minItems=1, this property is not required, so the minItems only apply when declared.",
                    "type": "array",
                    "minItems": 1,
                    "items": {"$ref": "#/definitions/Impact"}
                },
                "hasName": {
                    "description": "A name or label to assist in identifying a given Action in the context of the containing Vulnerability. This name should be unique across all sibling actions.",
                    "$ref": "#/definitions/name"
                }
            }
        },
        "Scenario": {
            "type": "object",
            "required": [
                "id",
                "requiresAttackTheatre",
                "evidencedBySource",
                "hasAction"
            ],
            "properties": {
                "id": {"$ref": "#/definitions/UUID"},
                "requiresAttackTheatre": {
                    "type": "string",
                    "enum": [
                        "Remote",
                        "Remote::Internet",
                        "Remote::Intranet",
                        "Remote::Local Network",
                        "Limited Remote",
                        "Limited Remote::Bluetooth",
                        "Limited Remote::Cellular",
                        "Limited Remote::Infrared",
                        "Limited Remote::Line of Sight",
                        "Limited Remote::Satellite",
                        "Limited Remote::Wireless",
                        "Local",
                        "Physical"
                    ]
                },
                "hasExploitedWeakness": {
                    "type": "array",
                    "minItems": 1,
                    "items": {"$ref": "#/definitions/ExploitedWeakness"}
                },
                "evidencedBySource": {
                    "type": "array",
                    "minItems": 1,
                    "items": {"$ref": "#/definitions/ResourceReference"}
                },
                "affectsProduct": {"$ref": "#/definitions/Product"},
                "blockedByBarrier": {
                    "type": "array",
                    "minItems": 1,
                    "items": {"$ref": "#/definitions/Barrier"}
                },
                "hasAction": {
                    "type": "array",
                    "minItems": 1,
                    "items": {"$ref": "#/definitions/Action"}
                },
                "hasName": {
                    "description": "A name or label to assist in identifying a given Scenario in the context of the containing Vulnerability. This name should be unique across all sibling scenarios.",
                    "$ref": "#/definitions/name"
                }
            }
        },
        "VulnerabilityType": {
            "type": "object",
            "required": [
                "hasIdentity",
                "hasOriginatingProduct",
                "hasScenario"
            ],
            "properties": {
                "hasSectorOfInterest": {
                    "type": "array",
                    "minItems": 1,
                    "uniqueItems": true,
                    "items": {"$ref": "#/definitions/SectorOfInterest"}
                },
                "hasOriginatingProduct": {"$ref": "#/definitions/Product"},
                "hasKnownChain": {
                    "type": "array",
                    "minItems": 1,
                    "uniqueItems": true,
                    "items": {"$ref": "#/definitions/VulnerabilityIdentifier"}
                },
                "hasIdentity": {
                    "type": "array",
                    "uniqueItems": true,
                    "minItems": 1,
                    "items": {"$ref": "#/definitions/VulnerabilityIdentifier"}
                },
                "hasScenario": {
                    "type": "array",
                    "uniqueItems": true,
                    "minItems": 1,
                    "items": {"$ref": "#/definitions/Scenario"}
                }
            },
            "additionalProperties": false
        },
        "SimpleScheme": {
            "type": "string",
            "format": "uri",
            "$comment": "Identifies the identification namespace, qualifying the values. For example, the if you are providing a CPE 2.3 identifier you would use 'https://csrc.nist.gov/ns/cpe/2.3' as the scheme.",
            "examples": [
                "https://csrc.nist.gov/ns/cpe/2.3",
                "http://example.org/my-scheme",
                "http://github.com/org/my-scheme"
            ]
        },
        "ResourceReference": {
            "type": "string",
            "format": "uri-reference",
            "$comment": "A URL pointing to a resolvable resource."
        }
    },
    "properties": {
        "Vulnerability": {"$ref": "#/definitions/VulnerabilityType"}
    },
    "required": ["Vulnerability"]
}