crowbarA CVE index inside your codebase
PyPI

Home / Showcase

crowbar case studies.

One question per case, the command that answers it, and the evidence behind the answer.

Case 01 · CVE triage

Is Log4Shell worth patching?

Memory knows CVSS is 10.0. It does not know whether anyone is actually using it. The index does.

crowbar cve CVE-2021-44228 
CVE-2021-44228  CRIT 10.0  KEV  epss 1.00  ssvc=active
affects  apache:log4j >=2.0.1 <2.3.1, >=2.13.0 <2.15.0 ...
KEV  added 2021-12-10  ransomware=Known
Exploit-DB (3)   Nuclei (44)   Metasploit (4)
crowbar returns
The exploitation signals, the affected ranges and the count of existing proof-of-concept code.
You get
That it is being exploited, that the fix is 2.17.1 or later, and that the rows say nothing about your own host.

The order matters. KEV leads, EPSS follows, CVSS is read last as the impact if it lands.

Case 02 · Applicability

Which nginx CVEs affect 1.18.0?

The same product, the same question, and a list two hundred entries shorter.

By product name 
$ crowbar search --product nginx

412 CVEs mention nginx
nginx 1.14.0  CRIT 7.5
nginx 1.17.0  HIGH 6.1
nginx 1.20.0  MED  4.3
… every version in the index
By version · matched ranges 
$ crowbar product nginx --version 1.18.0

2 real hits (version-matched)
CVE-2021-23017  HIGH 7.7  epss 0.53
  matched f5:nginx >=0.6.18 <1.20.1
CVE-2019-15517  MED  5.5
  matched jc21:nginx_proxy_manager <2.0.13

Each row carries the range that matched, so the agent can show its work and you can check it.

See the ranking rule

Rows are ordered by KEV, then SSVC exploitation state, then EPSS, then whether a working exploit exists. CVSS is included, but it never decides the order on its own.

Case 03 · Ecosystems

Which lodash version fixed the prototype pollution?

Package advisories carry the range that introduced the problem and the version that fixed it, so the answer can name the upgrade.

crowbar advisory --package lodash --ecosystem npm 
GHSA-jf85-cpcp-j695  prototype pollution in lodash
  range  introduced 0.0.0  fixed 4.17.12
GHSA-p6mc-m468-83gw  lodash.set prototype pollution
  range  introduced 0.0.0  fixed 4.17.17

The same advisory ids travel with the CVE record, so a triage answer and a package answer never disagree.

Case 04 · Proof of concept

Is there public exploit code for this?

Search by CVE, by description, or by a fragment of the code itself. Crowbar hands over the source; it never runs it.

crowbar code "jndi lookup ldap" 
data/exploitdb/full/.../50592.java
  … Payload.createBase64("ldap://…/Exploit") …
  … new JndiLookupHandler().lookup(…) …

The Nuclei templates and Metasploit modules for the same CVE are one command away, and public repository metadata is indexed too, so an agent can point at a reproduction without cloning anything.

Treat every downloaded exploit as untrusted code. Use a disposable VM.

Top