Rapid7, Inc.

Techniques for identifying vulnerabilities in a computing environment, including: using at least one computer hardware processor to perform: obtaining first vulnerability data for a first event from external data source(s); associating the first event with a particular vulnerability in a vulnerability dictionary using at least some of the first vulnerability data, the particular vulnerability being associated with one or more historical events; enriching the first vulnerability data with first metadata comprising one or more time-based feature values to obtain first enriched vulnerability data; generating a first set of feature values for the first event using both: the first enriched vulnerability data; and enriched vulnerability data for at least some of the one or more historical events; determining, using the first set of feature values, that a vulnerability mitigation action is to be triggered for the first event; and triggering performance of the vulnerability mitigation action for the first event.

Some embodiments provide techniques for generating common vulnerability scoring system (CVSS) vectors for vulnerabilities to use in scanning a computing environment for vulnerabilities. The techniques involve obtaining a textual description of a vulnerability; generating inputs for a plurality of ML models using the textual description of the vulnerability; providing the inputs to the plurality of ML models to obtain outputs indicating values of CVSS risk metrics; and storing the values of the CVSS risk metrics indicated by the outputs of the plurality of ML models in a vector to obtain the CVSS vector for the vulnerability.

Techniques for analyzing cybersecurity vulnerabilities in a computing environment, including: using at least one computer hardware processor to perform: (A) identifying a first cybersecurity vulnerability associated with a resource in the computing environment; (B) obtaining data related to one or more factors related to risk posed by the first cybersecurity vulnerability, the one or more factors including at least one factor indicative of a degree of current exploitation of the first cybersecurity vulnerability; (C) determining, using the obtained data, one or more factor weights for the one or more factors related to the risk posed by the first cybersecurity vulnerability; (D) determining a first score for the first cybersecurity vulnerability using the determined one or more factor weights; and (E) performing one or more security actions based on the determined first score for the first cybersecurity vulnerability.

Various embodiments include systems and methods to implement a complementary scan engine scheme for avoiding redundant vulnerability check data collection when using a scan engine to scan a target asset. The implementation may include determining a set of potential vulnerability checks for scanning the target asset using the scan engine. Fingerprint data indicating which versions of software are installed on the target asset may be collected. Based at least in part on the fingerprint data, it may be determined that a particular version of a local scan agent is installed on the target asset. Responsive to a determination that the local scan agent is functioning, the scan engine may perform any vulnerability check, in the set of potential vulnerability checks, that is not covered by the local scan agent. Responsive to a determination that the local scan agent is not functioning, the scan engine may perform all vulnerability checks in the set of potential vulnerability checks.

Techniques for analyzing cybersecurity vulnerabilities in a computing environment, including: using at least one computer hardware processor to perform: (A) identifying a first cybersecurity vulnerability associated with a resource in the computing environment; (B) obtaining data related to one or more factors related to risk posed by the first cybersecurity vulnerability, the one or more factors including at least one factor indicative of a degree of current exploitation of the first cybersecurity vulnerability; (C) determining, using the obtained data, one or more factor weights for the one or more factors related to the risk posed by the first cybersecurity vulnerability; (D) determining a first score for the first cybersecurity vulnerability using the determined one or more factor weights; and (E) performing one or more security actions based on the determined first score for the first cybersecurity vulnerability.

Techniques for analyzing cybersecurity vulnerabilities in a computing environment, including: using at least one computer hardware processor to perform: (A) identifying a first cybersecurity vulnerability associated with a resource in the computing environment; (B) obtaining data related to one or more factors related to risk posed by the first cybersecurity vulnerability, the one or more factors including at least one factor indicative of a degree of current exploitation of the first cybersecurity vulnerability; (C) determining, using the obtained data, one or more factor weights for the one or more factors related to the risk posed by the first cybersecurity vulnerability; (D) determining a first score for the first cybersecurity vulnerability using the determined one or more factor weights; and (E) performing one or more security actions based on the determined first score for the first cybersecurity vulnerability.

Systems and methods are disclosed for detecting code injection vulnerabilities in software systems. In embodiments, an injection string is created to implement an exploit against a software system. The exploit includes an unauthorized executable code that will generate an easily detectable token if executed by the software system. The string is injected into the software system during execution to simulate a code injection attack on the software system. The software system's execution result is obtained and analyzed to determine whether the execution detection token was generated. If so, the software system is proven to be vulnerable to the attack, and the vulnerability may be indicated in an alert or a report. The vulnerability detection technique may be for both software under development as well as production software systems running in the wild to analyze and monitor these systems for code injection vulnerabilities.

Various embodiments include systems and methods of assessing vendor risk. One or more sets of IP address(es) associated with one or more vendors is identified. Risk data related to the set(s) of IP address(es) is obtained using internet telemetry data. Based at least in part on the risk data, security risk level(s) are determined for the vendor(s). Some embodiments include systems and methods of implementing a vendor-based risk posture assessment of an organization. The vendor-based risk posture assessment may be based at least in part on one or more security risk levels determined for the vendor(s) of the organization.

Various embodiments include systems and methods of implementing a machine learning model for calculating confidence scores associated with potential security vulnerabilities. The machine learning model is trained using vulnerability data associated with a set of previously identified vulnerabilities, where the vulnerability data indicates whether a previously identified vulnerability is a true positive or a false positive. In some embodiments, scan traffic data may be obtained. The scan traffic data may be associated with potential security vulnerabilities detected via scan engine(s) that implement application security testing. The machine learning model may be used to determine respective confidence scores for each potential security vulnerability. According to some embodiments, responsive to a request for scan findings associated with a particular application, the respective confidence scores may be displayed via a vulnerability analysis graphical user interface.

An automated login framework for dynamic application security testing is disclosed. A web application executing on a computing device is accessed and an automated login framework (ALF) is injected into an onload event of a web browser associated with the web application. The ALF is then accessed with a credential associated with the web application. A login page associated with application is identified by matching links or buttons with a user-defined regular expression and a user-defined wordlist. Then, a login form in the login page is detected by executing a signature technique, a dictionary technique, and a multistep signature technique. The login form is populated using the credential and submitted for authentication, and a status with a confidence score is received indicating whether the authentication was successful or failed.