redteam-cve-validation

name	redteam-cve-validation
description	CVE validation domain card. Use after CVE lookup has produced applicable or candidate CVEs and red-team mode needs scoped evidence to decide whether to continue, pivot, or report.

CVE Validation

Domain

Validate candidate CVEs against the current target evidence without assuming exploitability. The module consumes cve_candidate_list, product/version evidence, service fingerprints, and scope data, then decides whether the CVE path is usable, patched, not applicable, or needs more recon.

Trigger

cve_candidate_list_ready

Feedback Gates

• Scope Gate: target and asset must be in the declared authorization boundary.
• Evidence Gate: candidate CVE must map to observed product, version, endpoint, service, or fingerprint evidence.
• Applicability Gate: version range, configuration, and reachable component must plausibly match.
• Patch Gate: observed version or vendor advisory must not prove the issue fixed.
• Execution Gate: active validation requires a registered scoped adapter; missing adapters block rather than pretending execution happened.

Boundaries

• Do not run destructive or broad exploit attempts.
• Do not validate outside the declared target and scope.
• Do not treat CVE names alone as proof.
• Prefer passive or low-noise confirmation first.
• If evidence is insufficient, return to recon or CVE lookup rather than guessing.

Pivot Hints

• Candidate has no product/version match -> return to recon-intake for better fingerprinting.
• Candidate is patched or not applicable -> route by highest-ranked attack surface from recon.
• Tool or adapter missing -> record missing capability and request/choose an equivalent adapter.
• Too many candidates -> rank by reachable component, confidence, impact, and version fit.

Exit Conditions

• Confirmed applicable candidate -> continue to the specific validation/testing skill.
• All candidates patched/not applicable -> exit to evidence-based router.
• Evidence incomplete -> return to recon-intake or cve-lookup.
• Required tool/scope/adapter missing -> block with the missing capability or scope evidence.

Exit Evidence

• Required: cve_validation_result
• Optional: cve_patch_status, applicability_proof, non_applicability_reason
• min_attempts: 1

Capabilities

cve_applicability     -> cve_validation_result
patch_status_check    -> cve_patch_status
page_fetch            -> applicability_proof