Reachability & Code Analysis
Relevant source files
The following files were used as context for generating this wiki page:
The Reachability & Code Analysis system is an enterprise-grade framework designed to determine if a vulnerability (such as a CVE) in a dependency is actually executable within the context of an application's codebase. It bridges the gap between static discovery and actual risk by combining design-time static analysis with runtime verification heuristics.
The system utilizes a multi-layered approach involving call graph construction, data-flow tracing, and proprietary consensus engines to provide high-confidence assessments. By identifying if an execution path exists from a public entry point (e.g., an API endpoint) to a vulnerable function, the system allows security teams to prioritize remediation based on actual exploitability rather than theoretical risk.
Sources: risk/reachability/analyzer.py:1-40, fixops-enterprise/src/services/advanced_pentest_engine.py:1020-1035
System Architecture
The analysis pipeline is orchestrated by the ReachabilityAnalyzer, which integrates several specialized components to perform hybrid analysis.
Core Components
| Component | Responsibility |
|---|---|
| ReachabilityAnalyzer | Orchestrates design-time and runtime analysis, extracts patterns from CVEs, and calculates final confidence scores. |
| CallGraphBuilder | Constructs a directed graph of function calls within the repository to identify potential execution chains. |
| DataFlowAnalyzer | Traces the movement of data through the application to determine if untrusted input can reach a vulnerable sink. |
| CodeAnalyzer | Interfaces with static analysis tools (e.g., Semgrep, Bandit) to find specific vulnerable code patterns. |
| GitRepositoryAnalyzer | Handles cloning and metadata extraction from target repositories. |
| Proprietary Engines | High-tier engines for scoring, consensus, and threat intelligence enrichment without OSS dependencies. |
Sources: risk/reachability/analyzer.py:75-120, fixops-enterprise/src/services/advanced_pentest_engine.py:1100-1120
High-Level Analysis Flow
The following diagram illustrates the sequence of operations when analyzing a vulnerability from a Git repository:
Vulnerability Pattern Extraction
The system transforms raw CVE details and Common Weakness Enumeration (CWE) identifiers into actionable VulnerablePattern objects. This allows the analyzers to search for specific dangerous function calls known to be associated with certain vulnerability classes.
Supported CWE Mappings
| CWE ID | Vulnerability Type | Target Functions |
|---|---|---|
| CWE-89 | SQL Injection | execute, query, prepareStatement, executeQuery |
| CWE-78 | Command Injection | exec, system, popen, subprocess |
| CWE-79 | XSS | innerHTML, document.write |
| CWE-22 | Path Traversal | open, read, write, file |
Sources: risk/reachability/analyzer.py:270-340, tests/risk/reachability/test_analyzer_core.py:120-170
Analysis Logic and Confidence Scoring
Call Chain Construction
The analyzer builds a CodePath by traversing the call graph backwards from a vulnerable "sink" function to an "entry point." An entry point is defined as a public API, a main function, or a function matching patterns like handler, route, or endpoint.
Sources: risk/reachability/analyzer.py:430-475, tests/risk/reachability/test_analyzer_core.py:345-375
Confidence Levels
Final results are assigned a ReachabilityConfidence level based on a calculated score (0.0 to 1.0):
- HIGH (>0.8): Multiple reachable paths found with high-fidelity data flow.
- MEDIUM (0.5-0.8): Paths identified in call graph but data flow or runtime verification is less certain.
- LOW (<0.5): Theoretical path exists but lacks sufficient evidence of invocation.
- UNKNOWN: Analysis could not be completed or no patterns were extracted.
Advanced Penetration Testing Integration
For enterprise deployments, reachability analysis is augmented by the WorldClassPenTestEngine. This engine uses the reachability data to simulate chained exploits and calculate business impact.
Attack Path Simulation
The engine analyzes the output of the reachability analyzer to identify:
- Chained Exploits: Combining multiple reachable vulnerabilities (e.g., an injection that leads to an auth bypass).
- Privilege Escalation Paths: Determining if a reachable path leads from an anonymous user to root/admin access.
- Lateral Movement: Identifying if reachable network functions (SSH, RDP, SMB) enable movement across systems.
Sources: fixops-enterprise/src/services/advanced_pentest_engine.py:750-850
Business Impact Quantification
When a path is confirmed reachable, the system quantifies the risk in financial terms:
- Record Cost: Based on data classification (e.g., $180 per "Confidential" record).
- Downtime Cost: Calculated using asset criticality and hourly revenue at risk.
- Regulatory Fines: Estimated impacts for GDPR, HIPAA, and PCI-DSS violations.
Sources: fixops-enterprise/src/services/advanced_pentest_engine.py:900-980
Conclusion
The Reachability & Code Analysis module serves as the primary intelligence layer for risk prioritization. By integrating static code analysis, graph theory (call graphs), and dynamic heuristics, it successfully filters out "noise" from security scanners—identifying only those vulnerabilities that pose a legitimate threat to the application's runtime environment. Its integration with the advanced pentest engine further extends this by providing executive-level financial risk assessments based on verified execution paths.
Sources: risk/reachability/analyzer.py:250-265, fixops-enterprise/src/services/advanced_pentest_engine.py:1250-1280