Interpret Contrast CVE Shield demo results
Most security tools tell you which libraries in your application have known Common Vulnerabilities and Exposures (CVEs). For a typical application, that list is long, and most entries look equally urgent. The hard part is deciding which ones deserve your attention now.
CVE Shield shows you the risk your application actually carries, not the theoretical risk. It does this by observing your application while it runs. In addition to reporting which libraries are loaded by your application at runtime, CVE Shield reports whether the vulnerable code is actually reached and whether anyone has attacked it. That turns a long list of theoretical risks into a short list of what is really happening in your environment.
What the CVE Shield demo does
The CVE Shield demo adds the Contrast agent to a sample application called Spring Pet Clinic, a widely used open source Java application, and enables CVE Shield. The Contrast agent is software that runs inside your application and observes it as it runs. The demo then sends requests that use a known vulnerable library in the application's EmailService.
The exploit is a Log4Shell attack request sent to the EmailService's /registerEmail endpoint. Log4Shell abuses the Java Naming and Directory Interface (JNDI) lookup feature in the log4j-core library, which can let an attacker run code on the server.
The request places a JNDI lookup string in a form field, and the string reaches log4j-core's JndiLookup.lookup method. That method is the sink, meaning the place in the code where untrusted input becomes dangerous. The CVE that CVE Shield monitors is CVE-2021-45046.
The CVE list
In Northstar, the Contrast web interface, when you go to Explorer > CVEs, you see the most recent status for this CVE across every demo run you have completed, not just the current run.
CVE Shield provides a list of all libraries your application loads at runtime. Before you test the application, most CVEs have a status of Not Seen, because CVE Shield has not recorded any activity related to them.
When you search for CVE-2021-45046, you will see its CVE Shield status, the affected library and version, and which of your environments (such as development or production) it affects.
The details of an exposed CVE
In Northstar, the Observations page is the authoritative record for each demo run. CVE Shield often reports both Exposed and Exploited observations for a CVE as it monitors code execution in the demo application.
Exposed tells you that the vulnerable library code has been reached, but nothing malicious has happened yet.
Exploited tells you that CVE Shield detected the vulnerable code running with input that matches a known attack pattern.
This is the information a dependency scan cannot give you. A library with a known CVE that never executes is a very different problem from one that runs on every request, and CVE Shield’s Exposed status is how you tell them apart.
Exploited is your signal to respond. It confirms that the vulnerable code was reached with input matching a known attack pattern, so the risk is no longer hypothetical. In an observation, the What happened? section shows the executed vulnerable method or process. This gives you evidence you can share with your security team without reconstructing events from logs.
Note
The CVE Shield Free tier runs in Monitor mode only. This means CVE Shield reports the exploit but does not block it. CVE Shield paid tiers add a Block mode, which also blocks the exploit.
CVEs, Issues, and Observations
In the CVE Shield demo, the Log4Shell exploit produces a CVE Shield observation. That observation is grouped under the issue for the root library that depends on log4j-core. In Northstar, three views describe the same underlying finding with different levels of detail, and each view is described below:
Observation: The most detailed view. One observation is created for each vulnerable library reached, and a single observation can cover multiple CVEs in that library. A CVE Shield observation records the CVE ID, the affected library, and the CVE Shield status at the moment of detection.
Issue: Contrast creates one issue for each root library, meaning each top-level library that your application directly depends on, in the application's dependency tree. If the vulnerable code is in a transitive dependency (a library that another library depends on), the observation is still grouped under the issue for the top-level library that includes it. You will not see a separate issue for the transitive dependency. An issue's CVEs tab lists every CVE under that root library, with a CVE Shield status column for each environment.
CVE (Explorer > CVEs): An organization-wide summary that combines every environment and every application affected by each detected CVE. It shows the most recent observation for each environment rather than a single run.
Each CVE Shield status corresponds to a level of urgency. Use the following table to decide where to focus your effort:
CVE Shield status | What it means | What to do |
|---|---|---|
Not Seen | The vulnerable code has not run in your application. | Lower urgency. Plan the upgrade as part of normal maintenance. |
Exposed | The vulnerable code has been reached, usually by normal traffic, and no attack was identified. | Prioritize the upgrade. The risk is real because attackers only need the right input. |
Exploited | The vulnerable code ran with input that matched a known attack pattern. | Respond immediately. Review the observation, confirm the impact, and upgrade the library. |
No Shield | CVE Shield has no policy available to monitor or block this CVE. This status also appears when the agent version is too old to support CVE Shield. | Check your Contrast agent version. Java agent version 6.33.1 or later, or Flex Agent version 2.2.2 or later is required for CVE Shield If it is below the minimum version CVE Shield supports, upgrade the agent. If the agent is current, prioritize this CVE using your dependency scan results. |
See Review Contrast CVE Shield states documentation for details on all available CVE Shield statuses.
Block mode
The Free tier runs in Monitor mode only, so you get the evidence but the exploit request still completes. That is enough to understand your current exposure and decide which libraries to upgrade first, with proof from your own application rather than a generic severity score.
A paid tier or a Protect license with Block mode configured for this CVE shows Blocked for the same request. CVE Shield stops the attack at runtime instead of only reporting it.