CVEngine is an open-source, self-hosted external attack surface management platform that combines asset discovery, CVE correlation, and read-only AI-validated verification for authorized security teams.
| Tool | hevnsnt/CVEngine — free, self-hosted external attack surface assessment with continuous discovery, evidence-based vulnerability validation, and AI triage |
| Category | Attack surface management / continuous vulnerability management |
| Primary Use | Mapping internet-facing assets you own — domains, subdomains, IPs, ports, products and versions — and matching them against actively exploited CVEs via bbot, nmap, naabu, and nuclei |
| Safe Use | Designed for defensive use on assets you own or are contractually authorized to assess; its validation layer is deliberately restricted to read-only checks, and AI-drafted nuclei templates never run without human approval |
| Telemetry Note | From the defender's seat, every check records the exact command it ran, and scanning produces the network signature of its underlying engines — naabu port sweeps, nmap fingerprints, and nuclei template probes — so blue teams can monitor their own scan traffic and the AI activity log |
CVEngine positions itself as enterprise-grade attack surface management without the license fee, and the README backs that claim with an unusually complete architecture. The tool takes a domain, IP range, CIDR, or URL you own and runs a continuous loop: discover assets, fingerprint every service and version, correlate them against live exploitation intelligence, and then attempt read-only reproduction of the findings. It is written in Python (the badge specifies Python 3.14), built on Django 5.2 LTS with PostgreSQL 18, Celery, Redis, nginx, and Gunicorn, and ships as a single Docker Compose stack with all scanners bundled. For defenders tired of juggling three disconnected products — asset inventory, a scanner, and a threat feed — this consolidation is the core pitch.
The discovery layer leans on bbot, the Black Lantern Security framework, running in passive, standard, and deep modes, with screenshots in the deep mode. A certificate transparency watch (crt.sh is credited in the third-party table) feeds newly observed hostnames straight into assessment, and every apex domain receives a deep sweep weekly. Targets are organized by organization and project and can be bulk-added, which suggests the tool assumes a fairly mature, multi-team operator rather than a one-off pentester. Once hosts exist, naabu performs a fast full-port sweep of each address before nmap fingerprints what answered, and a background one-host-at-a-time sweep of all 65,535 ports catches changes between scheduled scans.
The inventory model is explicitly Shodan-like: one record per host holding ports, services, products, versions, OS, banners, TLS state, and detected technologies. The search syntax makes this heritage obvious — the README shows queries like port:3389 -host:vpn, tech:"apache tomcat" sev:high, and ip:203.0.113.0/24 product:nginx. Anyone who has lived inside commercial ASM consoles will recognize this immediately; the difference is that the dataset never leaves your server, since the whole platform is self-hosted and, per the README, nothing is sent to the authors.
What elevates CVEngine above a re-bundled scanner stack is the correlation stage. It consumes the live cve.now feed plus CISA KEV, ENISA EUVD, Metasploit, Exploit-DB, EPSS, CVSS, and optionally VulnCheck KEV, and rates everything on a three-tier fire, smoke, or ice scale. Matched CVEs are then graded against your actual inventory by product and version, with distribution backports understood via OSV and the Debian security tracker — a detail that matters enormously in practice, since version-string naive matching is the single biggest source of false positives in Linux environments.
The AI layer is where the project earns its "AI-first" description, but the design shows deliberate restraint. AI triage sorts every finding into confirmed, likely, needs validation, likely false positive, or not applicable, and the README is explicit that fixed rules mean the model can never wave away hard evidence. Model access is bring-your-own: Anthropic, OpenAI, or OpenRouter API keys (stored encrypted), or fully local inference via Ollama and vLLM. Notably, the tool degrades gracefully — without any model configured it still discovers, scans, matches CVEs, and validates findings; the AI only adds triage, targeted scans, and template drafting.
Verification is built around evidence, not exploitation. The validation engine picks from a vetted nuclei template, a single-port nmap check, a banner probe, or one of the database exposure checks, and every check records the exact command it ran — an auditability posture many commercial products lack. When no template exists for a CVE, the AI drafts one, but it never runs against your hosts until a human approves it. An optional auto-fire mode that would test new CVEs against matching hosts as the feed delivers them exists but is off by default, which tells you the authors understood the risk of that automation.
The operational surface is broad. A live dashboard, an AI activity log, and a Changes page with side-by-side screenshot diffs (courtesy of gowitness, plus aardwolf for RDP screenshots) turn the inventory into a monitoring tool rather than a point-in-time report. New hosts, opened ports, version bumps, new certificates, appearing login pages, and changed front pages all land on a timeline — classic external change-detection. Web routes are labeled open, login, session required, SSO, or redirect, and exposure checks probe whether Redis, Memcached, PostgreSQL, Elasticsearch, and CouchDB answer without authentication, all read-only.
Email and domain hygiene is a pleasant surprise: SPF, DKIM, DMARC, CAA, MTA-STS, DANE, DNSSEC, and TLS are all evaluated, with the checks adapted from the open-source MailFail project. Hosts carry a 0-100 score with visible reasons, and can be rescanned, pinned, excluded, archived, or annotated with owner and criticality — the metadata plumbing that separates real ASM from a cron job running nuclei.
There is a bug bounty angle, gated behind an admin switch: a workbench that pulls program data from HackerOne, Bugcrowd, Intigriti, and YesWeHack via the bounty-targets-data repository, lets you point the scanner only at in-scope assets, and drafts reports from findings. Combined with the REST API, an OpenAPI spec, and an MCP server that runs under the same role-based permissions as humans (admin, user, audit), the platform is clearly aimed at teams who want automation agents to operate within governed boundaries rather than with raw keys.
Deployment is a single scripted path: on a Debian/Ubuntu host with at least 4 GB RAM (8 GB recommended) and 20 GB disk, sudo ./install.sh after git clone https://github.com/hevnsnt/CVEngine.git handles dependencies, generates secrets, provisions an HTTPS certificate, builds the Compose stack, and prints a one-time password. Two-step sign-in, an IP allowlist, and an audit log round out the access controls, and a single switch pauses all scanning — a control that will be appreciated the first time something goes wrong mid-engagement.
The appropriate frame here is fundamentally defensive. This is a tool for continuous monitoring of assets you own or are contracted to assess, with validation deliberately capped at read-only reproduction and AI-drafted checks held behind human approval. Pointing it at third-party infrastructure without authorization would be neither its intended use nor a safe one, and its noisy scan profile — full-port naabu sweeps and nuclei template probes — would be immediately visible to any competent blue team. At roughly 300 stars and licensed under GPL-3.0, it is a young project, but the README's architectural documentation (PIPELINE.md, ARCHITECTURE.md, SEARCH.md) suggests a maintainer investing in long-term operability rather than a weekend wrapper around existing scanners.
hevnsnt/CVEngine.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.