# Test Cases for `list_applications_by_cve` Tool

## Overview

The `list_applications_by_cve` tool finds applications and libraries affected by a specific CVE. Given a CVE ID, it returns:
- **cve**: CVE details including name, description, and severity
- **apps**: List of applications containing vulnerable libraries with class usage data
- **libraries**: The vulnerable library versions
- **impactStats**: Statistics about affected applications and servers

**Key feature**: Class usage data helps prioritize remediation:
- `classCount`: Total classes in the vulnerable library
- `classUsage`: Number of classes actually used by the application
- If `classUsage` is 0, the vulnerable code is likely NOT being executed

**Supported parameters:**
- `cveId` - CVE identifier (required, format: CVE-YYYY-NNNNN)

---

## Known Test Data (Sample)

The organization has applications with various CVEs. Below are representative samples:

| CVE ID | Severity | Library | Affected Apps | Description |
|--------|----------|---------|---------------|-------------|
| CVE-2021-44228 | Critical | log4j-core | 20 | Log4Shell - remote code execution via JNDI |
| CVE-2025-31651 | Critical | tomcat-embed-core | 70 | Apache Tomcat rewrite rule bypass |
| CVE-2025-41248 | High | spring-security-core | 21 | Spring Security annotation bypass |
| CVE-2025-22233 | Low | spring-context | 77 | Spring Framework disallowedFields bypass |
| CVE-2025-48989 | High | tomcat-embed-core | 70 | Apache Tomcat reset attack |

### Sample Applications for Verification

| App Name | App ID | CVEs Present |
|----------|--------|--------------|
| WebGoat_service27 | 526e0e38-68a4-4847-9420-a7eb83a11741 | CVE-2025-31651, CVE-2025-41248, CVE-2025-22233 |
| thib-contrast-cargo-cats-frontgateservice | 03c0a8d2-a6e6-46aa-b602-f242811d10bf | CVE-2021-44228 |
| Chris-Cargo-Cats-SmartFix-Demo-... | cac113a8-04a0-4c74-b289-20b90ea0672e | CVE-2021-44228 |

---

## Basic CVE Lookup Tests

### Test 1: Critical severity CVE (Log4Shell)
**Purpose:** Verify lookup of the well-known Log4Shell vulnerability returns comprehensive data.

**Prompt:**
```
use contrast mcp to find applications affected by CVE-2021-44228
```

**Expected Result:**
- `found: true`
- `success: true`
- CVE details including description mentioning "Log4j" and "JNDI"
- ~20 affected applications (impactedAppCount)
- Library versions: log4j-core versions 2.x (2.7, 2.8.2, 2.9.0, 2.10.0, 2.11.2, 2.12.1, 2.13.1, 2.14.1)
- Applications include: thib-contrast-cargo-cats-frontgateservice, Chris-Cargo-Cats-SmartFix-Demo-...
- Each app should have classCount and classUsage populated

---

### Test 2: Critical severity CVE (Tomcat)
**Purpose:** Verify lookup of Apache Tomcat CVE returns affected applications.

**Prompt:**
```
use contrast mcp to find applications affected by CVE-2025-31651
```

**Expected Result:**
- `found: true`
- ~70 affected applications
- Library: tomcat-embed-core (various versions 8.5.x, 9.0.x, 10.1.x, 11.0.x)
- Applications include: WebGoat_service27, petclinic applications, buildpack applications
- Description mentions "Apache Tomcat" and "rewrite rule"

---

### Test 3: High severity CVE (Spring Security)
**Purpose:** Verify lookup of Spring Security CVE.

**Prompt:**
```
use contrast mcp to find applications affected by CVE-2025-41248
```

**Expected Result:**
- `found: true`
- ~21 affected applications
- Library: spring-security-core (versions 6.4.2, 6.4.4)
- Description mentions "@PreAuthorize", "@EnableMethodSecurity", "authorization bypass"
- Applications include: WebGoat_service27, webgoat-pavanr, Buildpack applications

---

### Test 4: Low severity CVE (Spring Context)
**Purpose:** Verify lookup works for low severity CVEs.

**Prompt:**
```
use contrast mcp to find applications affected by CVE-2025-22233
```

**Expected Result:**
- `found: true`
- ~77 affected applications (larger impact)
- Library: spring-context (many versions from 2.0.1 to 6.2.6)
- Description mentions "disallowedFields" and "Spring Framework"
- Applications include widespread WebGoat and petclinic applications

---

### Test 5: High severity CVE (Tomcat DOS)
**Purpose:** Verify lookup of denial of service CVE.

**Prompt:**
```
use contrast mcp to find applications affected by CVE-2025-48989
```

**Expected Result:**
- `found: true`
- CVE description mentions "Improper Resource Shutdown" and "made you reset attack"
- Library: tomcat-embed-core
- Similar affected applications as CVE-2025-31651

---

## CVE Format Handling Tests

### Test 6: Standard CVE format (uppercase)
**Purpose:** Verify standard uppercase CVE format works.

**Prompt:**
```
use contrast mcp to find applications affected by CVE-2021-44228
```

**Expected Result:** Successfully returns Log4Shell data

---

### Test 7: CVE format case insensitivity
**Purpose:** Verify CVE lookup handles lowercase input.

**Prompt:**
```
use contrast mcp to find applications affected by cve-2021-44228
```

**Expected Result:** Either:
- Same results as Test 6 (case insensitive), OR
- Validation error indicating CVE must be uppercase

---

### Test 8: CVE format with extra whitespace
**Purpose:** Verify handling of CVE ID with surrounding whitespace.

**Prompt:**
```
use contrast mcp to find applications affected by " CVE-2021-44228 "
```

**Expected Result:** Either:
- Same results as Test 6 (whitespace trimmed), OR
- Validation error

---

## Error Handling Tests

### Test 9: Non-existent CVE
**Purpose:** Verify graceful handling of a CVE that doesn't exist in any library.

**Prompt:**
```
use contrast mcp to find applications affected by CVE-9999-99999
```

**Expected Result:**
- `success: true`
- `found: false`
- Warning message indicating CVE not found or doesn't affect any libraries
- `data: null`

---

### Test 10: Invalid CVE format (missing prefix)
**Purpose:** Verify validation rejects CVE without proper prefix.

**Prompt:**
```
use contrast mcp to find applications affected by 2021-44228
```

**Expected Result:**
- `success: false`
- Error message about invalid CVE format
- Should mention expected format like "CVE-YYYY-NNNNN"

---

### Test 11: Invalid CVE format (wrong pattern)
**Purpose:** Verify validation rejects malformed CVE ID.

**Prompt:**
```
use contrast mcp to find applications affected by CVE-INVALID-FORMAT
```

**Expected Result:**
- `success: false`
- Error message about invalid CVE format

---

### Test 12: Empty CVE ID
**Purpose:** Verify validation rejects empty input.

**Prompt:**
```
use contrast mcp to find applications affected by CVE ""
```

**Expected Result:**
- `success: false`
- Validation error for missing required parameter

---

### Test 13: CVE that exists but has no affected apps in org
**Purpose:** Verify handling when CVE is valid but no apps use affected libraries.

**Prompt:**
```
use contrast mcp to find applications affected by CVE-2014-0050
```

**Expected Result:** Either:
- `found: true` with empty apps list and warning message, OR
- `found: false` indicating no impact in this organization

---

## Class Usage Analysis Tests

### Test 14: Verify classCount and classUsage populated
**Purpose:** Confirm class usage data is populated for risk assessment.

**Prompt:**
```
use contrast mcp to find applications affected by CVE-2021-44228 and show me the class usage details
```

**Expected Result:**
- Each application should have:
  - `classCount`: Total classes in log4j-core (should be ~1093 for most apps)
  - `classUsage`: Number of classes actually used (typically 388-395)
- Applications with `classUsage > 0` indicate active exploitation risk

---

### Test 15: Identify low-risk applications (zero class usage)
**Purpose:** Verify ability to identify apps where vulnerable code isn't executed.

**Prompt:**
```
use contrast mcp to find applications affected by CVE-2025-31651 and identify which apps have the vulnerable code being used
```

**Expected Result:**
- Applications returned with classUsage data
- If any app has `classUsage: 0`, it indicates lower exploitation risk
- Tool should highlight that `classUsage: 0` means vulnerable library code is likely NOT being executed

---

## Impact Statistics Tests

### Test 16: Verify impact statistics
**Purpose:** Confirm impactStats provides useful metrics.

**Prompt:**
```
use contrast mcp to find applications affected by CVE-2025-31651 and show impact statistics
```

**Expected Result:**
- `impactStats` object with:
  - `impactedAppCount`: ~70
  - `totalAppCount`: ~8010 (total apps in org)
  - `impactedServerCount`: ~116
  - `totalServerCount`: ~224
  - `appPercentage`: ~0.9% of apps affected
  - `serverPercentage`: ~52% of servers affected

---

### Test 17: Compare impact across CVEs
**Purpose:** Verify impact statistics vary appropriately across CVEs.

**Prompt:**
```
use contrast mcp to compare the impact of CVE-2025-31651 vs CVE-2025-41248
```

**Expected Result:**
- CVE-2025-31651 (Tomcat): ~70 apps, ~52% servers
- CVE-2025-41248 (Spring Security): ~21 apps, ~15% servers
- Different libraries have different adoption rates

---

## Library Version Tests

### Test 18: Verify vulnerable library versions listed
**Purpose:** Confirm all affected library versions are returned.

**Prompt:**
```
use contrast mcp to find all vulnerable library versions for CVE-2021-44228
```

**Expected Result:**
- Multiple log4j library artifacts:
  - log4j-core (versions 2.6, 2.7, 2.8.2, 2.9.0, 2.10.0, 2.11.2, 2.12.1, 2.13.1, 2.14.1)
  - log4j-api (2.9.0)
  - log4j-slf4j-impl (2.9.0)
  - log4j-jul (2.9.0)
- Each library has hash, version, file_name, and group

---

### Test 19: Single library CVE
**Purpose:** Verify CVE affecting single library component.

**Prompt:**
```
use contrast mcp to find vulnerable library versions for CVE-2025-41248
```

**Expected Result:**
- Only spring-security-core library
- Versions: 6.4.2, 6.4.4
- Each with unique hash identifier

---

### Test 20: Many library versions CVE
**Purpose:** Verify CVE with many affected versions.

**Prompt:**
```
use contrast mcp to find vulnerable library versions for CVE-2025-22233
```

**Expected Result:**
- spring-context with 40+ versions
- Spanning versions from 2.0.1 to 6.2.6
- Shows long history of affected versions

---

## CVE Details Tests

### Test 21: Verify CVE description content
**Purpose:** Confirm CVE details include useful description.

**Prompt:**
```
use contrast mcp to get details about CVE-2021-44228
```

**Expected Result:**
- CVE name: "CVE-2021-44228"
- Description mentions:
  - "Apache Log4j2"
  - "JNDI"
  - "LDAP"
  - "remote code execution"
  - Version information (<=2.14.1)
  - Mitigation steps

---

### Test 22: Verify CVE with mitigation guidance
**Purpose:** Confirm CVE details include remediation information.

**Prompt:**
```
use contrast mcp to get details and mitigation for CVE-2025-22233
```

**Expected Result:**
- Description includes:
  - Affected versions (6.2.0 - 6.2.6, 6.1.0 - 6.1.19, etc.)
  - Fixed versions (6.2.7, 6.1.20, etc.)
  - Mitigation steps about "allowedFields" over "disallowedFields"

---

## Server Information Tests

### Test 23: Verify server data returned
**Purpose:** Confirm server information is included in results.

**Prompt:**
```
use contrast mcp to find applications and servers affected by CVE-2021-44228
```

**Expected Result:**
- Servers list populated with ~20 servers
- Each server includes:
  - server_id
  - name / hostname
  - path
  - type
  - environment (DEVELOPMENT, QA, PRODUCTION)
  - status

---

### Test 24: Verify server environments
**Purpose:** Confirm servers span different environments.

**Prompt:**
```
use contrast mcp to find what environments have applications affected by CVE-2021-44228
```

**Expected Result:**
- Servers in DEVELOPMENT environment
- Servers in QA environment
- Servers in PRODUCTION environment (e.g., thib-contrast-cargo-cats-frontgateservice)

---

## Cross-Reference Tests

### Test 25: Verify specific application appears in CVE results
**Purpose:** Cross-reference known vulnerable app with CVE results.

**Prompt:**
```
use contrast mcp to find if WebGoat_service27 is affected by CVE-2025-31651
```

**Expected Result:**
- WebGoat_service27 (app ID: 526e0e38-68a4-4847-9420-a7eb83a11741) should appear in apps list
- Should show classCount and classUsage for tomcat-embed-core

---

### Test 26: Multiple CVEs for same application
**Purpose:** Verify an application appears in multiple CVE queries.

**Prompt:**
```
use contrast mcp to check if WebGoat_service27 is affected by both CVE-2025-31651 and CVE-2025-41248
```

**Expected Result:**
- WebGoat_service27 appears in results for CVE-2025-31651 (Tomcat)
- WebGoat_service27 appears in results for CVE-2025-41248 (Spring Security)
- Different classCount/classUsage values for different libraries

---

## Edge Case Tests

### Test 27: CVE with very old year
**Purpose:** Test handling of old CVE identifiers.

**Prompt:**
```
use contrast mcp to find applications affected by CVE-2014-0160
```

**Expected Result:** Either:
- Results if Heartbleed-affected OpenSSL libraries exist, OR
- `found: false` with no applications affected

---

### Test 28: CVE with very long number
**Purpose:** Test handling of CVE with many digits.

**Prompt:**
```
use contrast mcp to find applications affected by CVE-2021-1234567
```

**Expected Result:**
- Proper handling (either results or not found)
- No parsing errors for longer CVE numbers

---

### Test 29: Recently published CVE
**Purpose:** Test handling of very recent CVE.

**Prompt:**
```
use contrast mcp to find applications affected by CVE-2025-49125
```

**Expected Result:**
- Results for recent Tomcat authentication bypass CVE
- Same affected applications as other Tomcat CVEs

---

## Natural Language Query Tests

### Test 30: Natural language - "Log4Shell"
**Purpose:** Test if AI maps common name to CVE.

**Prompt:**
```
use contrast mcp to find applications affected by Log4Shell
```

**Expected Result:** AI should recognize Log4Shell = CVE-2021-44228 and query appropriately

---

### Test 31: Natural language - "Spring4Shell"
**Purpose:** Test another well-known vulnerability name.

**Prompt:**
```
use contrast mcp to find applications affected by Spring4Shell
```

**Expected Result:** AI should map to CVE-2022-22965 and query (results depend on data)

---

### Test 32: Natural language - library name
**Purpose:** Test querying by library rather than CVE.

**Prompt:**
```
use contrast mcp to find applications using vulnerable versions of log4j
```

**Expected Result:** AI may suggest using list_application_libraries instead, or query known Log4j CVEs

---

## Comparison with Related Tools

### Test 33: Contrast with list_application_libraries
**Purpose:** Verify list_applications_by_cve and list_application_libraries are complementary.

**Prompt:**
```
use contrast mcp to first find apps affected by CVE-2021-44228, then get the full library list for one of those apps
```

**Expected Result:**
- First call returns affected apps
- Second call (list_application_libraries) shows full library inventory
- Can verify the vulnerable log4j-core version is present

---

### Test 34: Contrast with search_applications
**Purpose:** Verify application data consistency across tools.

**Prompt:**
```
use contrast mcp to find apps affected by CVE-2021-44228 and verify one app exists with search_applications
```

**Expected Result:**
- App ID from CVE results can be found via search_applications
- App metadata (name, language, tags) matches across tools

---

## Summary

| Test # | Category | Purpose | Expected Behavior |
|--------|----------|---------|-------------------|
| 1 | Basic | Log4Shell lookup | Returns ~20 apps, log4j libraries |
| 2 | Basic | Tomcat CVE lookup | Returns ~70 apps, tomcat libraries |
| 3 | Basic | Spring Security CVE | Returns ~21 apps |
| 4 | Basic | Low severity CVE | Returns ~77 apps |
| 5 | Basic | Tomcat DOS CVE | Returns affected apps |
| 6 | Format | Uppercase CVE | Success |
| 7 | Format | Lowercase CVE | Success or validation error |
| 8 | Format | Whitespace handling | Trimmed or error |
| 9 | Error | Non-existent CVE | found: false, warning |
| 10 | Error | Missing prefix | Validation error |
| 11 | Error | Malformed CVE | Validation error |
| 12 | Error | Empty CVE ID | Validation error |
| 13 | Error | Valid CVE, no apps | Empty list or not found |
| 14 | Class Usage | Verify populated | classCount/classUsage present |
| 15 | Class Usage | Zero usage risk | Identifies low-risk apps |
| 16 | Impact | Statistics verification | Accurate counts and percentages |
| 17 | Impact | Cross-CVE comparison | Different impact levels |
| 18 | Libraries | Multiple versions | All versions listed |
| 19 | Libraries | Single library | One library type |
| 20 | Libraries | Many versions | 40+ versions |
| 21 | CVE Details | Description content | Useful remediation info |
| 22 | CVE Details | Mitigation guidance | Fixed versions listed |
| 23 | Server | Data returned | Server list populated |
| 24 | Server | Environments | Multiple environments |
| 25 | Cross-Ref | Specific app check | App appears in results |
| 26 | Cross-Ref | Multiple CVEs | Same app, different CVEs |
| 27 | Edge Case | Old CVE year | Handles gracefully |
| 28 | Edge Case | Long CVE number | No parsing errors |
| 29 | Edge Case | Recent CVE | Returns results |
| 30 | NLP | "Log4Shell" name | Maps to CVE-2021-44228 |
| 31 | NLP | "Spring4Shell" name | Maps to CVE-2022-22965 |
| 32 | NLP | Library name query | Suggests appropriate tool |
| 33 | Comparison | With list_application_libraries | Complementary data |
| 34 | Comparison | With search_applications | Consistent app data |
