Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(db,server): add GetCveIDs #358

Merged
merged 3 commits into from
Apr 24, 2024
Merged

feat(db,server): add GetCveIDs #358

merged 3 commits into from
Apr 24, 2024

Conversation

MaineK00n
Copy link
Collaborator

What did you implement:

This PR allows you to obtain the CVE ID list registered in the DB.

Type of change

  • New feature (non-breaking change which adds functionality)

How Has This Been Tested?

$ curl http://127.0.0.1:1323/cves/ids
["CVE-2023-21043","CVE-2023-37256", ... ,"CVE-2023-46765"]

$ curl -X POST  -H "Content-Type: application/json" --data '["CVE-2023-0706", "CVE-2023-2569"]' http://127.0.0.1:1323/cves | jq
{
  "CVE-2023-0706": {
    "CveID": "CVE-2023-0706",
    "Nvds": [
      {
        "CveID": "CVE-2023-0706",
        "Descriptions": [
          {
            "Lang": "en",
            "Value": "A vulnerability, which was classified as critical, has been found in SourceCodester Medical Certificate Generator App 1.0. Affected by this issue is some unknown functionality of the file manage_record.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-220340."
          }
        ],
        "Cvss2": [
          {
            "Source": "cna@vuldb.com",
            "Type": "Secondary",
            "VectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "AccessVector": "NETWORK",
            "AccessComplexity": "LOW",
            "Authentication": "SINGLE",
            "ConfidentialityImpact": "PARTIAL",
            "IntegrityImpact": "PARTIAL",
            "AvailabilityImpact": "PARTIAL",
            "BaseScore": 6.5,
            "Severity": "MEDIUM",
            "ExploitabilityScore": 8,
            "ImpactScore": 6.4,
            "ObtainAllPrivilege": false,
            "ObtainUserPrivilege": false,
            "ObtainOtherPrivilege": false,
            "UserInteractionRequired": false
          }
        ],
        "Cvss3": [
          {
            "Source": "nvd@nist.gov",
            "Type": "Primary",
            "VectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "AttackVector": "NETWORK",
            "AttackComplexity": "LOW",
            "PrivilegesRequired": "LOW",
            "UserInteraction": "NONE",
            "Scope": "UNCHANGED",
            "ConfidentialityImpact": "HIGH",
            "IntegrityImpact": "HIGH",
            "AvailabilityImpact": "HIGH",
            "BaseScore": 8.8,
            "BaseSeverity": "HIGH",
            "ExploitabilityScore": 2.8,
            "ImpactScore": 5.9
          },
          {
            "Source": "cna@vuldb.com",
            "Type": "Secondary",
            "VectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "AttackVector": "NETWORK",
            "AttackComplexity": "LOW",
            "PrivilegesRequired": "LOW",
            "UserInteraction": "NONE",
            "Scope": "UNCHANGED",
            "ConfidentialityImpact": "LOW",
            "IntegrityImpact": "LOW",
            "AvailabilityImpact": "LOW",
            "BaseScore": 6.3,
            "BaseSeverity": "MEDIUM",
            "ExploitabilityScore": 2.8,
            "ImpactScore": 3.4
          }
        ],
        "Cwes": [
          {
            "Source": "cna@vuldb.com",
            "Type": "Primary",
            "CweID": "CWE-89"
          }
        ],
        "Cpes": [
          {
            "URI": "cpe:/a:medical_certificate_generator_app_project:medical_certificate_generator_app:1.0",
            "FormattedString": "cpe:2.3:a:medical_certificate_generator_app_project:medical_certificate_generator_app:1.0:*:*:*:*:*:*:*",
            "WellFormedName": "wfn:[part=\"a\", vendor=\"medical_certificate_generator_app_project\", product=\"medical_certificate_generator_app\", version=\"1\\.0\", update=ANY, edition=ANY, language=ANY, sw_edition=ANY, target_sw=ANY, target_hw=ANY, other=ANY]",
            "Part": "a",
            "Vendor": "medical_certificate_generator_app_project",
            "Product": "medical_certificate_generator_app",
            "Version": "1\\.0",
            "Update": "ANY",
            "Edition": "ANY",
            "Language": "ANY",
            "SoftwareEdition": "ANY",
            "TargetSW": "ANY",
            "TargetHW": "ANY",
            "Other": "ANY",
            "VersionStartExcluding": "",
            "VersionStartIncluding": "",
            "VersionEndExcluding": "",
            "VersionEndIncluding": "",
            "EnvCpes": []
          }
        ],
        "References": [
          {
            "Link": "https://vuldb.com/?ctiid.220340",
            "Source": "cna@vuldb.com",
            "Tags": "Permissions Required,Third Party Advisory",
            "Name": "https://vuldb.com/?ctiid.220340"
          },
          {
            "Link": "https://vuldb.com/?id.220340",
            "Source": "cna@vuldb.com",
            "Tags": "Third Party Advisory",
            "Name": "https://vuldb.com/?id.220340"
          }
        ],
        "Certs": [],
        "PublishedDate": "2023-02-07T10:15:52.61Z",
        "LastModifiedDate": "2023-11-07T04:01:16.2Z",
        "DetectionMethod": ""
      }
    ],
    "Jvns": [],
    "Fortinets": []
  },
  "CVE-2023-2569": {
    "CveID": "CVE-2023-2569",
    "Nvds": [
      {
        "CveID": "CVE-2023-2569",
        "Descriptions": [
          {
            "Lang": "en",
            "Value": "\nA CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service,\nelevation of privilege, and potentially kernel execution when a malicious actor with local user\naccess crafts a script/program using an IOCTL call in the Foxboro.sys driver.\n\n"
          }
        ],
        "Cvss2": [],
        "Cvss3": [
          {
            "Source": "nvd@nist.gov",
            "Type": "Primary",
            "VectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "AttackVector": "LOCAL",
            "AttackComplexity": "LOW",
            "PrivilegesRequired": "LOW",
            "UserInteraction": "NONE",
            "Scope": "UNCHANGED",
            "ConfidentialityImpact": "HIGH",
            "IntegrityImpact": "HIGH",
            "AvailabilityImpact": "HIGH",
            "BaseScore": 7.8,
            "BaseSeverity": "HIGH",
            "ExploitabilityScore": 1.8,
            "ImpactScore": 5.9
          },
          {
            "Source": "cybersecurity@se.com",
            "Type": "Secondary",
            "VectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "AttackVector": "LOCAL",
            "AttackComplexity": "LOW",
            "PrivilegesRequired": "LOW",
            "UserInteraction": "NONE",
            "Scope": "UNCHANGED",
            "ConfidentialityImpact": "HIGH",
            "IntegrityImpact": "HIGH",
            "AvailabilityImpact": "HIGH",
            "BaseScore": 7.8,
            "BaseSeverity": "HIGH",
            "ExploitabilityScore": 1.8,
            "ImpactScore": 5.9
          }
        ],
        "Cwes": [
          {
            "Source": "cybersecurity@se.com",
            "Type": "Primary",
            "CweID": "CWE-787"
          }
        ],
        "Cpes": [
          {
            "URI": "cpe:/a:schneider-electric:ecostruxure_foxboro_dcs_control_core_services:-",
            "FormattedString": "cpe:2.3:a:schneider-electric:ecostruxure_foxboro_dcs_control_core_services:-:*:*:*:*:*:*:*",
            "WellFormedName": "wfn:[part=\"a\", vendor=\"schneider\\-electric\", product=\"ecostruxure_foxboro_dcs_control_core_services\", version=NA, update=ANY, edition=ANY, language=ANY, sw_edition=ANY, target_sw=ANY, target_hw=ANY, other=ANY]",
            "Part": "a",
            "Vendor": "schneider\\-electric",
            "Product": "ecostruxure_foxboro_dcs_control_core_services",
            "Version": "NA",
            "Update": "ANY",
            "Edition": "ANY",
            "Language": "ANY",
            "SoftwareEdition": "ANY",
            "TargetSW": "ANY",
            "TargetHW": "ANY",
            "Other": "ANY",
            "VersionStartExcluding": "",
            "VersionStartIncluding": "",
            "VersionEndExcluding": "",
            "VersionEndIncluding": "",
            "EnvCpes": []
          }
        ],
        "References": [
          {
            "Link": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-164-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-164-04.pdf",
            "Source": "cybersecurity@se.com",
            "Tags": "Vendor Advisory",
            "Name": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-164-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-164-04.pdf"
          }
        ],
        "Certs": [],
        "PublishedDate": "2023-06-14T08:15:09.113Z",
        "LastModifiedDate": "2023-06-22T18:06:50.047Z",
        "DetectionMethod": ""
      }
    ],
    "Jvns": [],
    "Fortinets": []
  }
}

Checklist:

You don't have to satisfy all of the following.

  • Write tests
  • Write documentation
  • Check that there aren't other open pull requests for the same issue/feature
  • Format your source code by make fmt
  • Pass the test by make test
  • Provide verification config / commands
  • Enable "Allow edits from maintainers" for this PR
  • Update the messages below

Is this ready for review?: YES

Reference

@MaineK00n MaineK00n self-assigned this Jan 8, 2024
@MaineK00n MaineK00n force-pushed the MaineK00n/get-cveids branch 2 times, most recently from 473b13d to 7dffcd5 Compare January 9, 2024 14:23
@MaineK00n MaineK00n force-pushed the MaineK00n/get-cveids branch from 7dffcd5 to 6e6b143 Compare April 24, 2024 00:05
@MaineK00n MaineK00n force-pushed the MaineK00n/get-cveids branch from 6e6b143 to 1b82cc8 Compare April 24, 2024 00:09
@MaineK00n MaineK00n requested a review from shino April 24, 2024 01:16
Copy link
Collaborator

@shino shino left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perfect!

@MaineK00n MaineK00n merged commit 7d9560e into master Apr 24, 2024
5 checks passed
@MaineK00n MaineK00n deleted the MaineK00n/get-cveids branch April 24, 2024 10:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants