Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(mitre): fill DataType, DataVersion, affected #395

Merged
merged 1 commit into from
Jul 5, 2024
Merged

feat(mitre): fill DataType, DataVersion, affected #395

merged 1 commit into from
Jul 5, 2024

Conversation

MaineK00n
Copy link
Collaborator

@MaineK00n MaineK00n commented Jul 4, 2024 •
edited
Loading

If this Pull Request is work in progress, Add a prefix of “[WIP]” in the title.

What did you implement:

fill DataType, DataVersion, affected

Type of change

  • New feature (non-breaking change which adds functionality)

How Has This Been Tested?

before

$ go-cve-dictionary fetch mitre 2024
$ go-cve-dictionary search cve CVE-2024-5732
{
  "CveID": "CVE-2024-5732",
  "Nvds": [],
  "Jvns": [],
  "Fortinets": [],
  "Mitres": [
    {
      "DataType": "",
      "DataVersion": "",
      "CVEMetadata": {
        "CVEID": "CVE-2024-5732",
        "AssignerOrgID": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "AssignerShortName": "VulDB",
        "RequesterUserID": null,
        "Serial": null,
        "State": "PUBLISHED",
        "DatePublished": "2024-06-07T10:00:04.02Z",
        "DateUpdated": "2024-06-07T14:50:46.944Z",
        "DateReserved": "2024-06-07T05:12:19.233Z",
        "DateRejected": null
      },
      "Containers": [
        {
          "ContainerType": "CNA",
          "ProviderMetadata": {
            "OrgID": "1af790b2-7ee1-4545-860a-a788eba489b5",
            "ShortName": "VulDB",
            "DateUpdated": "2024-06-07T10:00:04.02Z"
          },
          "Title": "Clash Proxy Port improper authentication",
          "Descriptions": [
            {
              "Lang": "en",
              "Value": "A vulnerability was found in Clash up to 0.20.1 on Windows. It has been declared as critical. This vulnerability affects unknown code of the component Proxy Port. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. VDB-267406 is the identifier assigned to this vulnerability.",
              "SupportingMedia": []
            },
            {
              "Lang": "de",
              "Value": "In Clash bis 0.20.1 für Windows wurde eine Schwachstelle ausgemacht. Sie wurde als kritisch eingestuft. Das betrifft eine unbekannte Funktionalität der Komponente Proxy Port. Durch das Manipulieren mit unbekannten Daten kann eine improper authentication-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung. Als bestmögliche Massnahme werden Anpassungen an der Konfiguration empfohlen.",
              "SupportingMedia": []
            }
          ],
          "ProblemTypes": [
            {
              "Descriptions": [
                {
                  "Type": "CWE",
                  "Lang": "en",
                  "Description": "CWE-287 Improper Authentication",
                  "CweID": "CWE-287",
                  "References": []
                }
              ]
            }
          ],
          "Impacts": [],
          "Metrics": [
            {
              "Format": "CVSS",
              "Scenarios": [],
              "CVSSv2": null,
              "CVSSv30": null,
              "CVSSv31": null,
              "CVSSv40": {
                "VectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
                "baseScore": 6.9,
                "BaseSeverity": "MEDIUM",
                "ThreatScore": null,
                "ThreatSeverity": null,
                "EnvironmentalScore": null,
                "EnvironmentalSeverity": null
              },
              "SSVC": null,
              "KEV": null,
              "Other": null
            },
            {
              "Format": "CVSS",
              "Scenarios": [],
              "CVSSv2": null,
              "CVSSv30": null,
              "CVSSv31": {
                "VectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                "AttackVector": "",
                "AttackComplexity": "",
                "PrivilegesRequired": "",
                "UserInteraction": "",
                "Scope": "",
                "ConfidentialityImpact": "",
                "IntegrityImpact": "",
                "AvailabilityImpact": "",
                "BaseScore": 7.3,
                "BaseSeverity": "HIGH",
                "ExploitabilityScore": 0,
                "ImpactScore": 0
              },
              "CVSSv40": null,
              "SSVC": null,
              "KEV": null,
              "Other": null
            },
            {
              "Format": "CVSS",
              "Scenarios": [],
              "CVSSv2": null,
              "CVSSv30": {
                "VectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                "AttackVector": "",
                "AttackComplexity": "",
                "PrivilegesRequired": "",
                "UserInteraction": "",
                "Scope": "",
                "ConfidentialityImpact": "",
                "IntegrityImpact": "",
                "AvailabilityImpact": "",
                "BaseScore": 7.3,
                "BaseSeverity": "HIGH",
                "ExploitabilityScore": 0,
                "ImpactScore": 0
              },
              "CVSSv31": null,
              "CVSSv40": null,
              "SSVC": null,
              "KEV": null,
              "Other": null
            },
            {
              "Format": "CVSS",
              "Scenarios": [],
              "CVSSv2": {
                "VectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "AccessVector": "",
                "AccessComplexity": "",
                "Authentication": "",
                "ConfidentialityImpact": "",
                "IntegrityImpact": "",
                "AvailabilityImpact": "",
                "BaseScore": 7.5,
                "Severity": ""
              },
              "CVSSv30": null,
              "CVSSv31": null,
              "CVSSv40": null,
              "SSVC": null,
              "KEV": null,
              "Other": null
            }
          ],
          "Workarounds": [],
          "Solutions": [],
          "Exploits": [],
          "Configurations": [],
          "References": [
            {
              "Link": "https://vuldb.com/?id.267406",
              "Source": "",
              "Tags": "vdb-entry",
              "Name": "VDB-267406 | Clash Proxy Port improper authentication"
            },
            {
              "Link": "https://vuldb.com/?ctiid.267406",
              "Source": "",
              "Tags": "signature,permissions-required",
              "Name": "VDB-267406 | CTI Indicators (IOB, IOC)"
            },
            {
              "Link": "https://vuldb.com/?submit.345469",
              "Source": "",
              "Tags": "third-party-advisory",
              "Name": "Submit #345469 | clash for windows 0.10-0.0.20.1 Unverified Ownership"
            },
            {
              "Link": "https://github.com/GTA12138/vul/blob/main/clash%20for%20windows.md",
              "Source": "",
              "Tags": "exploit",
              "Name": ""
            }
          ],
          "Timeline": [
            {
              "Time": "2024-06-07T00:00:00Z",
              "Lang": "en",
              "Value": "Advisory disclosed"
            },
            {
              "Time": "2024-06-07T02:00:00Z",
              "Lang": "en",
              "Value": "VulDB entry created"
            },
            {
              "Time": "2024-06-07T07:17:38Z",
              "Lang": "en",
              "Value": "VulDB entry last update"
            }
          ],
          "Credits": [
            {
              "Type": "reporter",
              "Lang": "en",
              "User": null,
              "Value": "rollingchair (VulDB User)"
            }
          ],
          "Source": "",
          "Tags": [],
          "TaxonomyMappings": [],
          "DateAssigned": null,
          "DatePublic": null
        },
        {
          "ContainerType": "ADP",
          "ProviderMetadata": {
            "OrgID": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "ShortName": "CISA-ADP",
            "DateUpdated": "2024-06-07T14:50:46.944Z"
          },
          "Title": "CISA ADP Vulnrichment",
          "Descriptions": [],
          "ProblemTypes": [],
          "Impacts": [],
          "Metrics": [
            {
              "Format": "SSVC",
              "Scenarios": [],
              "CVSSv2": null,
              "CVSSv30": null,
              "CVSSv31": null,
              "CVSSv40": null,
              "SSVC": {
                "Role": "CISA Coordinator",
                "Version": "2.0.3",
                "Timestamp": "2024-06-07T14:50:35.35155Z",
                "Exploitation": "none",
                "Automatable": "no",
                "TechnicalImpact": "partial"
              },
              "KEV": null,
              "Other": null
            }
          ],
          "Workarounds": [],
          "Solutions": [],
          "Exploits": [],
          "Configurations": [],
          "References": [],
          "Timeline": [],
          "Credits": [],
          "Source": "",
          "Tags": [],
          "TaxonomyMappings": [],
          "DateAssigned": null,
          "DatePublic": null
        }
      ]
    }
  ]
}

after

$ go-cve-dictionary fetch mitre 2024
$ go-cve-dictionary search cve CVE-2024-5732
{
  "CveID": "CVE-2024-5732",
  "Nvds": [],
  "Jvns": [],
  "Fortinets": [],
  "Mitres": [
    {
      "DataType": "CVE_RECORD",
      "DataVersion": "5.1",
      "CVEMetadata": {
        "CVEID": "CVE-2024-5732",
        "AssignerOrgID": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "AssignerShortName": "VulDB",
        "RequesterUserID": null,
        "Serial": null,
        "State": "PUBLISHED",
        "DatePublished": "2024-06-07T10:00:04.02Z",
        "DateUpdated": "2024-06-07T14:50:46.944Z",
        "DateReserved": "2024-06-07T05:12:19.233Z",
        "DateRejected": null
      },
      "Containers": [
        {
          "ContainerType": "CNA",
          "ProviderMetadata": {
            "OrgID": "1af790b2-7ee1-4545-860a-a788eba489b5",
            "ShortName": "VulDB",
            "DateUpdated": "2024-06-07T10:00:04.02Z"
          },
          "Title": "Clash Proxy Port improper authentication",
          "Descriptions": [
            {
              "Lang": "en",
              "Value": "A vulnerability was found in Clash up to 0.20.1 on Windows. It has been declared as critical. This vulnerability affects unknown code of the component Proxy Port. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. VDB-267406 is the identifier assigned to this vulnerability.",
              "SupportingMedia": []
            },
            {
              "Lang": "de",
              "Value": "In Clash bis 0.20.1 für Windows wurde eine Schwachstelle ausgemacht. Sie wurde als kritisch eingestuft. Das betrifft eine unbekannte Funktionalität der Komponente Proxy Port. Durch das Manipulieren mit unbekannten Daten kann eine improper authentication-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung. Als bestmögliche Massnahme werden Anpassungen an der Konfiguration empfohlen.",
              "SupportingMedia": []
            }
          ],
          "Affected": [
            {
              "Vendor": "n/a",
              "Product": "Clash",
              "CollectionURL": null,
              "PackageName": null,
              "Cpes": [],
              "Modules": [
                {
                  "Module": "Proxy Port"
                }
              ],
              "ProgramFiles": [],
              "ProgramRoutines": [],
              "Platforms": [],
              "Repo": null,
              "DefaultStatus": null,
              "Versions": [
                {
                  "Status": "affected",
                  "VersionType": null,
                  "Version": "0.20.0",
                  "LessThan": null,
                  "LessThanOrEqual": null,
                  "Changes": []
                },
                {
                  "Status": "affected",
                  "VersionType": null,
                  "Version": "0.20.1",
                  "LessThan": null,
                  "LessThanOrEqual": null,
                  "Changes": []
                }
              ]
            }
          ],
          "ProblemTypes": [
            {
              "Descriptions": [
                {
                  "Type": "CWE",
                  "Lang": "en",
                  "Description": "CWE-287 Improper Authentication",
                  "CweID": "CWE-287",
                  "References": []
                }
              ]
            }
          ],
          "Impacts": [],
          "Metrics": [
            {
              "Format": "CVSS",
              "Scenarios": [],
              "CVSSv2": null,
              "CVSSv30": null,
              "CVSSv31": null,
              "CVSSv40": {
                "VectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
                "baseScore": 6.9,
                "BaseSeverity": "MEDIUM",
                "ThreatScore": null,
                "ThreatSeverity": null,
                "EnvironmentalScore": null,
                "EnvironmentalSeverity": null
              },
              "SSVC": null,
              "KEV": null,
              "Other": null
            },
            {
              "Format": "CVSS",
              "Scenarios": [],
              "CVSSv2": null,
              "CVSSv30": null,
              "CVSSv31": {
                "VectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                "AttackVector": "",
                "AttackComplexity": "",
                "PrivilegesRequired": "",
                "UserInteraction": "",
                "Scope": "",
                "ConfidentialityImpact": "",
                "IntegrityImpact": "",
                "AvailabilityImpact": "",
                "BaseScore": 7.3,
                "BaseSeverity": "HIGH",
                "ExploitabilityScore": 0,
                "ImpactScore": 0
              },
              "CVSSv40": null,
              "SSVC": null,
              "KEV": null,
              "Other": null
            },
            {
              "Format": "CVSS",
              "Scenarios": [],
              "CVSSv2": null,
              "CVSSv30": {
                "VectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                "AttackVector": "",
                "AttackComplexity": "",
                "PrivilegesRequired": "",
                "UserInteraction": "",
                "Scope": "",
                "ConfidentialityImpact": "",
                "IntegrityImpact": "",
                "AvailabilityImpact": "",
                "BaseScore": 7.3,
                "BaseSeverity": "HIGH",
                "ExploitabilityScore": 0,
                "ImpactScore": 0
              },
              "CVSSv31": null,
              "CVSSv40": null,
              "SSVC": null,
              "KEV": null,
              "Other": null
            },
            {
              "Format": "CVSS",
              "Scenarios": [],
              "CVSSv2": {
                "VectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                "AccessVector": "",
                "AccessComplexity": "",
                "Authentication": "",
                "ConfidentialityImpact": "",
                "IntegrityImpact": "",
                "AvailabilityImpact": "",
                "BaseScore": 7.5,
                "Severity": ""
              },
              "CVSSv30": null,
              "CVSSv31": null,
              "CVSSv40": null,
              "SSVC": null,
              "KEV": null,
              "Other": null
            }
          ],
          "Workarounds": [],
          "Solutions": [],
          "Exploits": [],
          "Configurations": [],
          "References": [
            {
              "Link": "https://vuldb.com/?id.267406",
              "Source": "",
              "Tags": "vdb-entry",
              "Name": "VDB-267406 | Clash Proxy Port improper authentication"
            },
            {
              "Link": "https://vuldb.com/?ctiid.267406",
              "Source": "",
              "Tags": "signature,permissions-required",
              "Name": "VDB-267406 | CTI Indicators (IOB, IOC)"
            },
            {
              "Link": "https://vuldb.com/?submit.345469",
              "Source": "",
              "Tags": "third-party-advisory",
              "Name": "Submit #345469 | clash for windows 0.10-0.0.20.1 Unverified Ownership"
            },
            {
              "Link": "https://github.com/GTA12138/vul/blob/main/clash%20for%20windows.md",
              "Source": "",
              "Tags": "exploit",
              "Name": ""
            }
          ],
          "Timeline": [
            {
              "Time": "2024-06-07T00:00:00Z",
              "Lang": "en",
              "Value": "Advisory disclosed"
            },
            {
              "Time": "2024-06-07T02:00:00Z",
              "Lang": "en",
              "Value": "VulDB entry created"
            },
            {
              "Time": "2024-06-07T07:17:38Z",
              "Lang": "en",
              "Value": "VulDB entry last update"
            }
          ],
          "Credits": [
            {
              "Type": "reporter",
              "Lang": "en",
              "User": null,
              "Value": "rollingchair (VulDB User)"
            }
          ],
          "Source": "",
          "Tags": [],
          "TaxonomyMappings": [],
          "DateAssigned": null,
          "DatePublic": null
        },
        {
          "ContainerType": "ADP",
          "ProviderMetadata": {
            "OrgID": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "ShortName": "CISA-ADP",
            "DateUpdated": "2024-06-07T14:50:46.944Z"
          },
          "Title": "CISA ADP Vulnrichment",
          "Descriptions": [],
          "Affected": [],
          "ProblemTypes": [],
          "Impacts": [],
          "Metrics": [
            {
              "Format": "SSVC",
              "Scenarios": [],
              "CVSSv2": null,
              "CVSSv30": null,
              "CVSSv31": null,
              "CVSSv40": null,
              "SSVC": {
                "Role": "CISA Coordinator",
                "Version": "2.0.3",
                "Timestamp": "2024-06-07T14:50:35.35155Z",
                "Exploitation": "none",
                "Automatable": "no",
                "TechnicalImpact": "partial"
              },
              "KEV": null,
              "Other": null
            }
          ],
          "Workarounds": [],
          "Solutions": [],
          "Exploits": [],
          "Configurations": [],
          "References": [],
          "Timeline": [],
          "Credits": [],
          "Source": "",
          "Tags": [],
          "TaxonomyMappings": [],
          "DateAssigned": null,
          "DatePublic": null
        }
      ]
    }
  ]
}

Checklist:

You don't have to satisfy all of the following.

  • Write tests
  • Write documentation
  • Check that there aren't other open pull requests for the same issue/feature
  • Format your source code by make fmt
  • Pass the test by make test
  • Provide verification config / commands
  • Enable "Allow edits from maintainers" for this PR
  • Update the messages below

Is this ready for review?: YES

Reference

@MaineK00n MaineK00n self-assigned this Jul 4, 2024
@jbmaillet
Copy link

Tested OK with:

This also answer my question in comment #392 (comment)

Cannot see a difference regarding "affected" of course, no change in the code about this.

Minor: you probably forgot something in the "after" above, same as "before".

@jbmaillet jbmaillet mentioned this pull request Jul 4, 2024
Merged
10 tasks
@MaineK00n MaineK00n marked this pull request as ready for review July 4, 2024 18:19
@MaineK00n MaineK00n requested a review from shino July 4, 2024 18:19
@shino
Copy link
Collaborator

shino commented Jul 5, 2024

before/after diff

--- before.txt	2024-07-05 09:39:58.294334024 +0900
+++ after.txt	2024-07-05 09:40:17.166817550 +0900
@@ -7,8 +7,8 @@
   "Fortinets": [],
   "Mitres": [
     {
-      "DataType": "",
-      "DataVersion": "",
+      "DataType": "CVE_RECORD",
+      "DataVersion": "5.1",
       "CVEMetadata": {
         "CVEID": "CVE-2024-5732",
         "AssignerOrgID": "1af790b2-7ee1-4545-860a-a788eba489b5",
@@ -42,6 +42,43 @@
               "SupportingMedia": []
             }
           ],
+          "Affected": [
+            {
+              "Vendor": "n/a",
+              "Product": "Clash",
+              "CollectionURL": null,
+              "PackageName": null,
+              "Cpes": [],
+              "Modules": [
+                {
+                  "Module": "Proxy Port"
+                }
+              ],
+              "ProgramFiles": [],
+              "ProgramRoutines": [],
+              "Platforms": [],
+              "Repo": null,
+              "DefaultStatus": null,
+              "Versions": [
+                {
+                  "Status": "affected",
+                  "VersionType": null,
+                  "Version": "0.20.0",
+                  "LessThan": null,
+                  "LessThanOrEqual": null,
+                  "Changes": []
+                },
+                {
+                  "Status": "affected",
+                  "VersionType": null,
+                  "Version": "0.20.1",
+                  "LessThan": null,
+                  "LessThanOrEqual": null,
+                  "Changes": []
+                }
+              ]
+            }
+          ],
           "ProblemTypes": [
             {
               "Descriptions": [
@@ -218,6 +255,7 @@
           },
           "Title": "CISA ADP Vulnrichment",
           "Descriptions": [],
+          "Affected": [],
           "ProblemTypes": [],
           "Impacts": [],
           "Metrics": [

shino
shino approved these changes Jul 5, 2024
View reviewed changes
Copy link
Collaborator

@shino shino left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🌞

@MaineK00n MaineK00n merged commit af25e2c into master Jul 5, 2024
6 checks passed
@MaineK00n MaineK00n deleted the MaineK00n/mitre branch July 5, 2024 01:33
@jbmaillet
Copy link

I can confirm I see the MITRE details for "affected" with the precise sha1 and the list of involved source code files as ""ProgramFiles" for ex on CVE-2024-36971. I must have missed a pull request or something.

@MaineK00n this is a fantastic change for me! I do embedded systems, and build everything from sources. Thus I have a compilation database generated with bear, and the full git history. These 2 types of data allow to filter the 95% of false positive CVE on my kernels. Previously I would resort to some heuristics and could only reach max 75% automatic filtering. But with these changes, go-cve-dictionary gives me the potential to go up to 95% with pure automation. This changes everything for me. Thank you so much to you and your colleagues! 🤩 🎆 🍾 🥳

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@shino shino shino approved these changes

Assignees

@MaineK00n MaineK00n

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@MaineK00n @jbmaillet @shino