BUG: Importing SCAP for Windows Server 2016/2019 error

[18gold]

Bug Location

I found a bug in the:

• API
• UI
• Elsewhere (Please specify)

Bug Description:
Importing SCAP (XCCDF) results for Windows Server 2016/2019 results in:
Cannot read property 'check-content-ref' of undefined

• I have checked to see if there is already an existing issue that describes this bug.

To Reproduce
Steps to reproduce the behavior:

1. Open a collection
2. Click on 'Manage'
3. From 'Assets' click 'Import CKL or SCAP...'
4. Browse to XCCDF results for Windows 2016/2019
5. Error

Expected behavior
Expected to import SCAP results

Actual behavior
Error and no results are impoted

Environment or Configuration:

• Docker Container
• Browser: Chrome

[csmig]

Curious. Which SCAP engine produced these results? The XCCDF standard does not require that property, but the SCC tool has always included it, at least up through this winter. SCC is the tool I've written our parser against.

If possible, please look into the XCCDF content for instances of the <cdf:check> element descended from <cdf:TestResult><cdf:rule-result> there should be hundreds of them. The parser is expecting a <xccdf:check-content-ref> child element to be present. An example:

<cdf:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
    <xccdf:check-content-ref name="oval:mil.disa.stig.windows:def:2137" href="U_MS_Windows_Server_2019_V2R1_STIG_SCAP_1-2_Benchmark-oval.xml" />
</cdf:check>

It looks like the parser did not expect either of these elements to be missing. I can fix that, but I'd like to understand the toolchain that produced an XCCDF without one or more of these elements.

Thank you.

[csmig]

@18gold Also, please provide the version of STIG Manager you're using. The latest release actually regressed a bit in supporting XCCDF so the fact you got as far as you did suggests you might not be using 1.0.0-beta.30?

I've been refactoring the parsers to cope with the nuances of CKL processing and I know that XCCDF support has regressed. I intend to deal with that the next day or so. There are some challenges matching SCAP to Manual STIGs because very often the Manual benchmarkId differs from the Benchmark benchmarkId. We need to maintain a mapping table, DISA does make this challenging.

[18gold]

@csmig
STIG Manager Version: 1.0.0-beta.25
SCC Engine: 5.4

I looked into the XCCDF file and the formatting is a bit different than the supposedly expected element you suggested above. Could be causing the issue:

<cdf:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
         <cdf:check-content-ref name="oval:mil.disa.stig.windows:def:1020" href="U_MS_Windows_Server_2016_V2R1_STIG_SCAP_1-2_Benchmark-oval.xml"></cdf:check-content-ref>
</cdf:check>

[csmig]

@18gold Thanks for the very helpful info. One more question -- do results from other Benchmarks import okay for you?

The error you got suggests at least one of the <cdf:rule-result> elements doesn't contain a child <cdf:check> and the parser can't handle that. I'll run the same Benchmark myself and see what I get but I need to modify the parser no matter what.

Annoyingly, this is really not a critical element for us to process, it is informational.

I'm rearchitecting SCAP handling this next week so this will work properly soon. Very much appreciate your report.

[cd-rite]

Hi @18gold I can't recreate this issue with files generated by SCC 5.4, either in our latest STIGMan or the one you specified.

Are you having this issue with every XCCDF file you try to import, or just this one?

Can you verify that the XML element you provided was from within a <cdf:TestResult><cdf:rule-result> element? They are usually at the bottom of a results file.
All the check elements I have from that section include a "#scap_mil.disa.stig_comp_" prefix to the href= attribute.
This prefix difference wouldn't cause this problem, but it's the only difference I can identify at the moment.

[18gold]

@csmig yes, other Benchmarks import okay. Only Windows Server 2016/2019 are erroring.

@cd-rite We've only had issues specifically with Windows Server 2016/2019 Benchmarks. I'm linking the element from the last section of the file I last tried.

<cdf:check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
         <cdf:check-content-ref name="oval:mil.disa.stig.windows:def:1257" href="#scap_mil.disa.stig_comp_U_MS_Windows_Server_2016_V2R1_STIG_SCAP_1-2_Benchmark-oval.xml"></cdf:check-content-ref>
</cdf:check>

[csmig]

I would like to understand why there are missing elements, even if I can code around around them. Perhaps you could share a redacted version of your file?

To assist with that, here is an XSLT that redacts an XCCDF TestResult, removing any target identifying info and setting all results to pass.

redact-scc.xslt

<?xml version="1.0"?>
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:cdf="http://checklists.nist.gov/xccdf/1.2" xmlns:cpe2="http://cpe.mitre.org/language/2.0" exclude-result-prefixes="cpe2">
    <xsl:output method="xml" indent="yes"/>
    <xsl:strip-space elements="*"/>
    <xsl:template match="@*|node()">
        <xsl:copy>
            <xsl:apply-templates select="@*|node()"/>
        </xsl:copy>
    </xsl:template>
    <xsl:template match="comment()"/>
    <xsl:template match="cdf:profile"/>
    <xsl:template match="cdf:target-address"/>
    <xsl:template match="cdf:target-facts"/>
    <xsl:template match="cdf:target-id-ref"/>
    <xsl:template match="cdf:set-value"/>
    <xsl:template match="cdf:score">
        <cdf:score maximum="1" system="urn:xccdf:scoring:absolute">0</cdf:score>
    </xsl:template>
    <xsl:template match="cdf:identity">
        <cdf:identity privileged="true" authenticated="true">TEST</cdf:identity>
    </xsl:template>
    <xsl:template match="cdf:target">
        <cdf:target>TEST</cdf:target>
    </xsl:template>
    <xsl:template match="cdf:result">
        <cdf:result>pass</cdf:result>
    </xsl:template>
</xsl:stylesheet>

You'll need an XSLT processor, there are many choices depending on your platform. I used xmlstarlet to process the above, it is bundled with most Linux package distributions (for Ubuntu: apt install xmlstarlet) and there's a Windows download as well. But any other tool of your choice should be fine, too.

xmlstarlet tr redact-scc.xslt YOUR_SCC_RESULT_FILE > redacted_xccdf.xml

If possible, please run this transform against a file that is not importing and attach the redacted result. You'll need to change the extension to TXT. Thanks for any further assistance you can provide.