dradis-nexpose 4.11.0 → 4.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fefa5d899cb4a34cead8f685c4bd13efdea29d034ddb7a505ce0e00f23b9b17d
-  data.tar.gz: 713ae33f6884e7c75393055f4cf68932a4ec9ef310e722d333b34c83df8b65ba
+  metadata.gz: b5b342a73c3a4576df7bd68d24142393480c9abed09cd8f7a8c2f9aefe67339e
+  data.tar.gz: 4d24a2ed95a57a001e9f909740fd95067332065804d282598c2b86d31db6b644
 SHA512:
-  metadata.gz: 7a07af401d0dbe92e6d488244502eae76d2404482429190b8e7a68117c97e79e850905b0ab71954024137e9144125de3169866ef2749343c9b0d909c7e3027e1
-  data.tar.gz: 69b31e47e60b9ee6bbd6771222ea1a8f5940bf9d40c6700e789bee6a546a2b296d087b9a75fc850c32f827c9ac917bd22cbc16ebffed2ed6449f5ac8ca77023b
+  metadata.gz: '0080d88c9b79f02f1a9610d85aa350f26e3c059fae144c15a1ccb66c6acf69e69e076063c2d7451915e9a625892f1fc9a519f099aed3e9577edfa4278cb24b5d'
+  data.tar.gz: 9231e9e9a60fe0b06316f024b0f089c76bda3c4bcb4000f0eb4079da893ee295daf59cfabe5f47b85b6f989f2e72b1f87ed988c499ccc64a880a29c9a52e8bbd

data/CHANGELOG.md

@@ -1,8 +1,13 @@
+v4.12.0 (May 2024)
+ - Migrate integration to use Mappings Manager
+ - Update Dradis links in README
+
 v4.11.0 (January 2024)
   - Add port/protocol to evidences
   - Use the details in <os> as the OS node property
   - Import `vulnerability.risk_score` as a new Issue field
   - Allow multiple evidence with the same test id & node address
+  - Add support for tests that start with `ContainerBlockElement`
 
 v4.10.0 (September 2023)
   - Update gemspec links

data/README.md

@@ -6,8 +6,7 @@ The Nexpose add-on enables users to upload Nexpose XML files to create a structu
 
 This plugin supports both NeXpose-Simple and NeXpose-Full formats.
 
-The add-on requires [Dradis CE](https://dradisframework.org/) > 3.0, or [Dradis Pro](https://dradisframework.com/pro/).
-
+The add-on requires [Dradis CE](https://dradis.com/ce/) > 3.0, or [Dradis Pro](https://dradis.com/).
 
 ## More information
 

data/lib/dradis/plugins/nexpose/formats/full.rb

@@ -14,7 +14,7 @@ module Dradis::Plugins::Nexpose::Formats
       logger.info { "\tProcessing scan summary" }
 
       doc.xpath('//scans/scan').each do |xml_scan|
-        note_text = template_service.process_template(template: 'full_scan', data: xml_scan)
+        note_text = mapping_service.apply_mapping(source: 'full_scan', data: xml_scan)
         content_service.create_note(node: scan_node, text: note_text)
       end
 
@@ -26,7 +26,7 @@ module Dradis::Plugins::Nexpose::Formats
         logger.info { "\tProcessing host: #{nexpose_node.address}" }
 
         # add the summary note for this host
-        note_text = template_service.process_template(template: 'full_node', data: nexpose_node)
+        note_text = mapping_service.apply_mapping(source: 'full_node', data: nexpose_node)
         content_service.create_note(node: host_node, text: note_text)
 
         if host_node.respond_to?(:properties)
@@ -83,7 +83,7 @@ module Dradis::Plugins::Nexpose::Formats
           endpoint.services.each do |service|
 
             # add the summary note for this service
-            note_text = template_service.process_template(template: 'full_service', data: service)
+            note_text = mapping_service.apply_mapping(source: 'full_service', data: service)
             # content_service.create_note(node: endpoint_node, text: note_text)
             content_service.create_note(node: host_node, text: note_text)
 
@@ -123,8 +123,8 @@ module Dradis::Plugins::Nexpose::Formats
       doc.xpath('//VulnerabilityDefinitions/vulnerability').each do |xml_vulnerability|
         id = xml_vulnerability['id'].downcase
         # if @vuln_list.include?(id)
-        issue_text = template_service.process_template(
-          template: 'full_vulnerability',
+        issue_text = mapping_service.apply_mapping(
+          source: 'full_vulnerability',
           data: xml_vulnerability
         )
 
@@ -148,8 +148,8 @@ module Dradis::Plugins::Nexpose::Formats
           host_node = content_service.create_node(label: host_name, type: :host)
 
           evidence[id][host_name].each do |evidence|
-            evidence_content = template_service.process_template(
-              template: 'full_evidence',
+            evidence_content = mapping_service.apply_mapping(
+              source: 'full_evidence',
               data: evidence
             )
             content_service.create_evidence(content: evidence_content, issue: issue, node: host_node)

data/lib/dradis/plugins/nexpose/formats/simple.rb

@@ -26,7 +26,7 @@ module Dradis::Plugins::Nexpose::Formats
           port_node = content_service.create_node(label: port_label, parent: host_node)
 
           findings.each do |id, finding|
-            port_text = template_service.process_template(template: 'simple_port', data: {id: id, finding: finding})
+            port_text = mapping_service.apply_mapping(source: 'simple_port', data: {id: id, finding: finding})
             port_text << "\n#[host]#\n#{host['address']}\n\n"
             content_service.create_note node: port_node, text: port_text
           end

data/lib/dradis/plugins/nexpose/gem_version.rb

@@ -8,7 +8,7 @@ module Dradis
 
       module VERSION
         MAJOR = 4
-        MINOR = 11
+        MINOR = 12
         TINY = 0
         PRE = nil
 

data/lib/dradis/plugins/nexpose/mapping.rb

@@ -0,0 +1,101 @@
+module Dradis::Plugins::Nexpose
+  module Mapping
+    DEFAULT_MAPPING = {
+      full_evidence: {
+        'ID' => '{{ nexpose[evidence.id] }}',
+        'Status' => '{{ nexpose[evidence.status] }}',
+        'Content' => '{{ nexpose[evidence.content] }}'
+      },
+      full_node: {
+        'Title' => '{{ nexpose[node.address] }}',
+        'Hostname' => '{{ nexpose[node.site_name] }}',
+        'Details' => "Status: {{ nexpose[node.status] }}\nDevice id: {{ nexpose[node.device_id] }}\nHW address: {{ nexpose[node.hardware_address] }}",
+        'Names' => '{{ nexpose[node.names] }}',
+        'Software' => '{{ nexpose[node.software] }}'
+      },
+      full_scan: {
+        'Title' => '{{ nexpose[scan.name] }} ({{ nexpose[scan.scan_id] }})',
+        'Timing' => "Start time: {{ nexpose[scan.start_time] }}\nEnd time: {{ nexpose[scan.end_time] }}",
+        'Status' => '{{ nexpose[scan.status] }}'
+      },
+      full_service: {
+        'Title' => 'Service name: {{ nexpose[service.name] }}',
+        'Fingerprinting' => '{{ nexpose[service.fingerprints] }}',
+        'Configuration' => '{{ nexpose[service.configurations] }}',
+        'Tests' => '{{ nexpose[service.tests] }}'
+      },
+      full_vulnerability: {
+        'Title' => '{{ nexpose[vulnerability.title] }}',
+        'Nexpose Id' => '{{ nexpose[vulnerability.nexpose_id] }}',
+        'Severity' => '{{ nexpose[vulnerability.severity] }}',
+        'PCI Severity' => '{{ nexpose[vulnerability.pci_severity] }}',
+        'CVSS Score' => '{{ nexpose[vulnerability.cvss_score] }}',
+        'CVSS Vector' => '{{ nexpose[vulnerability.cvss_vector] }}',
+        'Published' => '{{ nexpose[vulnerability.published] }}',
+        'Description' => '{{ nexpose[vulnerability.description] }}',
+        'Solution' => '{{ nexpose[vulnerability.solution] }}',
+        'References' => '{{ nexpose[vulnerability.references] }}',
+        'Tags' => '{{ nexpose[vulnerability.tags] }}'
+      },
+      simple_port: {
+        'Id' => '{{ nexpose[port.id] }}',
+        'References' => '{{ nexpose[port.finding] }}'
+      }
+    }.freeze
+
+    SOURCE_FIELDS = {
+      full_evidence: [
+        'evidence.id',
+        'evidence.status',
+        'evidence.content',
+        'evidence.port',
+        'evidence.protocol'
+      ],
+      full_node: [
+        'node.address',
+        'node.device_id',
+        'node.fingerprints',
+        'node.hardware_address',
+        'node.names',
+        'node.tests',
+        'node.risk_score',
+        'node.site_name',
+        'node.status',
+        'node.software'
+      ],
+      full_scan: [
+        'scan.end_time',
+        'scan.name',
+        'scan.scan_id',
+        'scan.start_time',
+        'scan.status'
+      ],
+      full_service: [
+        'service.configurations',
+        'service.fingerprints',
+        'service.name',
+        'service.tests'
+      ],
+      full_vulnerability: [
+        'vulnerability.added',
+        'vulnerability.cvss_score',
+        'vulnerability.cvss_vector',
+        'vulnerability.description',
+        'vulnerability.modified',
+        'vulnerability.nexpose_id',
+        'vulnerability.pci_severity',
+        'vulnerability.published',
+        'vulnerability.risk_score',
+        'vulnerability.references',
+        'vulnerability.severity',
+        'vulnerability.solution',
+        'vulnerability.tags',
+        'vulnerability.title'
+      ],
+      simple_port: [
+        'port.finding',
+        'port.id'
+      ]
+    }.freeze
+  end
+end

data/lib/dradis/plugins/nexpose.rb

@@ -8,4 +8,5 @@ end
 require 'dradis/plugins/nexpose/engine'
 require 'dradis/plugins/nexpose/field_processor'
 require 'dradis/plugins/nexpose/importer'
+require 'dradis/plugins/nexpose/mapping'
 require 'dradis/plugins/nexpose/version'

data/lib/nexpose/test.rb

@@ -2,13 +2,20 @@ module Nexpose
   class Test
     def self.new(xml_node)
       content =
-        if xml_node.at_xpath('./Paragraph')
-          xml_node.
-            at_xpath('./Paragraph').
-            text.
-            split("\n").
-            collect(&:strip).
-            reject { |line| line.empty? }.join("\n")
+        # get first Paragraph or ContainerBlockElement that's a direct child of <test>
+        if xml = xml_node.at_xpath('./Paragraph | ./ContainerBlockElement')
+          # get all nested paragraph elements
+          nested_paragraphs = xml.xpath('.//Paragraph')
+
+          content = nested_paragraphs.children.map do |node|
+            case node.name
+            when 'text'
+              node.text.strip
+            when 'URLLink'
+              node['LinkURL']
+            end
+          end.compact
+          content.map(&:strip).reject(&:empty?).join("\n")
         else
           'n/a'
         end

data/spec/fixtures/files/full.xml

@@ -20,23 +20,32 @@
                 <fingerprint certainty="0.90" family="NTP" product="NTP" vendor="Cisco"/>
               </fingerprints>
               <configuration>
-                <config name="ntp.variables">system=&quot;cisco&quot;, leap=0, stratum=5, rootdelay=88.21,
-
-rootdispersion=108.54, peer=24960, refid=135.89.100.96,
-
-reftime=0xD80BB6B5.715ACDD8, poll=10, clock=0xD80BB78F.8931F3F6,
-
-phase=8.259, freq=-141.24, error=11.32</config>
+                <config name="ntp.variables">system=&quot;cisco&quot;, leap=0, stratum=5, rootdelay=88.21,rootdispersion=108.54, peer=24960, refid=135.89.100.96,reftime=0xD80BB6B5.715ACDD8, poll=10, clock=0xD80BB78F.8931F3F6,phase=8.259, freq=-141.24, error=11.32</config>
               </configuration>
               <tests>
                 <test id="ntp-clock-variables-disclosure" pci-compliance-status="pass" scan-id="4" status="vulnerable-exploited" vulnerable-since="20141110T161846666">
                   <Paragraph>
-                    <Paragraph>The following NTP variables were found from a readvar request: system=&quot;cisco&quot;, leap=0, stratum=5, rootdelay=88.21,
-rootdispersion=108.54, peer=24960, refid=135.89.100.96,
-reftime=0xD80BB6B5.715ACDD8, poll=10, clock=0xD80BB78F.8931F3F6,
-phase=8.259, freq=-141.24, error=11.32</Paragraph>
+                    <Paragraph>The following NTP variables were found from a readvar request: system=&quot;cisco&quot;, leap=0, stratum=5, rootdelay=88.21, rootdispersion=108.54, peer=24960, refid=135.89.100.96, reftime=0xD80BB6B5.715ACDD8, poll=10, clock=0xD80BB78F.8931F3F6,phase=8.259, freq=-141.24, error=11.32</Paragraph>
                   </Paragraph>
                 </test>
+                <test id="test-02" pci-compliance-status="pass" scan-id="4" status="vulnerable-exploited" vulnerable-since="20141110T161846666">
+                  <ContainerBlockElement>
+                    <Paragraph>Vulnerable URL:
+                      <URLLink LinkURL="https://1.2.3.4/" LinkTitle="https://1.2.3.4/"></URLLink>
+                      More info
+                    </Paragraph>
+                    <Paragraph>CRAWL TRAFFIC
+                      Vulnerable response matched:
+                    </Paragraph>
+                    <Paragraph>ATTACK TRAFFIC
+                      Vulnerability proven via 1 attack
+                      <Paragraph>(1) Attack proof:
+                      Attack description:
+                      Missing HTTP header &quot;Content-Security-Policy&quot;
+                      Vulnerable response matched:
+                    </Paragraph></Paragraph>
+                  </ContainerBlockElement>
+                </test>
               </tests>
             </service>
           </services>
@@ -86,7 +95,7 @@ phase=8.259, freq=-141.24, error=11.32</Paragraph>
         </ContainerBlockElement>
       </solution>
     </vulnerability>
-    <vulnerability added="20120412T000000000" cvssScore="4.3" cvssVector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" id="ntp-clock-variables-disclosure" modified="20130828T000000000" pciSeverity="3" published="20031231T000000000" riskScore="549.07043" severity="4" title="Apache HTTPD: ETag Inode Information Leakage (CVE-2003-1418)">
+    <vulnerability added="20120412T000000000" cvssScore="4.3" cvssVector="(AV:N/AC:M/Au:N/C:P/I:N/A:N)" id="test-02" modified="20130828T000000000" pciSeverity="3" published="20031231T000000000" riskScore="549.07043" severity="4" title="Apache HTTPD: ETag Inode Information Leakage (CVE-2003-1418)">
       <malware/>
       <exploits/>
       <description>
@@ -110,33 +119,19 @@ phase=8.259, freq=-141.24, error=11.32</Paragraph>
           <UnorderedList>
             <ListItem>
               <Paragraph>
-                <Paragraph>You can remove inode information from the ETag header by adding the
-    following directive to your Apache config:</Paragraph>
+                <Paragraph>You can remove inode information from the ETag header by adding the following directive to your Apache config:</Paragraph>
                 <Paragraph preformat="true">FileETag MTime Size</Paragraph>
               </Paragraph>
             </ListItem>
             <ListItem>
               <Paragraph>OpenBSD</Paragraph>
               <Paragraph>Download and apply the patch from:
-
-
-
-
-
                 <URLLink LinkTitle="http://www.openbsd.org/errata32.html#httpd" LinkURL="http://www.openbsd.org/errata32.html#httpd"/></Paragraph>
               <Paragraph>
                 <Paragraph>The OpenBSD team has released a
-
-
-
-
-
                   <URLLink LinkTitle="http://www.openbsd.org/errata32.html#httpd" LinkURL="http://www.openbsd.org/errata32.html#httpd" href="http://www.openbsd.org/errata32.html#httpd">
-                    patch</URLLink>for the Apache inode and pid leak problem.  This patch can be applied
-    cleanly to 3.2 stable and rebuilt.  Restart httpd for the changes to
-    take effect.  OpenBSD 3.3 will ship with the patched httpd by default.
-    The patch can be applied to earlier 3.x versions of OpenBSD, but it
-    may require editing of the source code.</Paragraph>
+                    patch</URLLink>for the Apache inode and pid leak problem.  This patch can be applied cleanly to 3.2 stable and rebuilt.  Restart httpd for the changes to take effect.  OpenBSD 3.3 will ship with the patched httpd by default. The patch can be applied to earlier 3.x versions of OpenBSD, but it may require editing of the source code.
+                </Paragraph>
               </Paragraph>
             </ListItem>
           </UnorderedList>

data/spec/nexpose_upload_spec.rb

@@ -119,7 +119,7 @@ describe 'Nexpose upload plugin' do
 
         expect(@content_service).to receive(:create_issue) do |args|
           expect(args[:text]).to include("#[Title]#\nApache HTTPD: ETag Inode Information Leakage (CVE-2003-1418)")
-          expect(args[:id]).to eq('ntp-clock-variables-disclosure')
+          expect(args[:id]).to eq('test-02')
           OpenStruct.new(args)
         end.once
 
@@ -129,6 +129,12 @@ describe 'Nexpose upload plugin' do
           expect(args[:node].label).to eq('1.1.1.1')
         end.once
 
+        expect(@content_service).to receive(:create_evidence) do |args|
+          expect(args[:content]).to include("#[ID]#\ntest-02\n\n")
+          expect(args[:issue].id).to eq('test-02')
+          expect(args[:node].label).to eq('1.1.1.1')
+        end.once
+
         @importer.import(file: @fixtures_dir + '/full.xml')
 
         expect(Node.find_by(label: '1.1.1.1').properties[:os]).to eq('IOS')
@@ -144,7 +150,7 @@ describe 'Nexpose upload plugin' do
       end
 
       # Regression test for github.com/dradis/dradis-nexpose/issues/1
-      it 'populates solutions regardless they are wrapped in paragraphs or lists' do
+      it 'populates solutions regardless of if they are wrapped in paragraphs or lists' do
         expect(@content_service).to receive(:create_issue) do |args|
           expect(args[:text]).to include("#[Solution]#\n\nApache HTTPD >= 2.0 and < 2.0.65")
           OpenStruct.new(args)
@@ -159,6 +165,20 @@ describe 'Nexpose upload plugin' do
         @importer.import(file: @fixtures_dir + '/full.xml')
       end
 
+      it 'populates tests regardless of if they contain paragraphs or containerblockelements' do
+        expect(@content_service).to receive(:create_evidence) do |args|
+          expect(args[:content]).to include("#[Content]#\nThe following NTP variables")
+          OpenStruct.new(args)
+        end.once
+  
+        expect(@content_service).to receive(:create_evidence) do |args|
+          expect(args[:content]).to include("#[Content]#\nVulnerable URL:")
+          OpenStruct.new(args)
+        end.once
+
+        @importer.import(file: @fixtures_dir + '/full.xml')
+      end
+
       it 'transforms html entities (&lt; and &gt;)' do
         expect(@content_service).to receive(:create_issue) do |args|
           expect(args[:text]).to include("#[Solution]#\n\nApache HTTPD >= 2.0 and < 2.0.65")

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dradis-nexpose
 version: !ruby/object:Gem::Version
-  version: 4.11.0
+  version: 4.12.0
 platform: ruby
 authors:
 - Daniel Martin
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-01-17 00:00:00.000000000 Z
+date: 2024-05-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dradis-plugins
@@ -121,6 +121,7 @@ files:
 - lib/dradis/plugins/nexpose/formats/simple.rb
 - lib/dradis/plugins/nexpose/gem_version.rb
 - lib/dradis/plugins/nexpose/importer.rb
+- lib/dradis/plugins/nexpose/mapping.rb
 - lib/dradis/plugins/nexpose/version.rb
 - lib/nexpose/endpoint.rb
 - lib/nexpose/node.rb
@@ -135,24 +136,12 @@ files:
 - spec/fixtures/files/ssl.xml
 - spec/nexpose_upload_spec.rb
 - spec/spec_helper.rb
-- templates/full_evidence.fields
 - templates/full_evidence.sample
-- templates/full_evidence.template
-- templates/full_node.fields
 - templates/full_node.sample
-- templates/full_node.template
-- templates/full_scan.fields
 - templates/full_scan.sample
-- templates/full_scan.template
-- templates/full_service.fields
 - templates/full_service.sample
-- templates/full_service.template
-- templates/full_vulnerability.fields
 - templates/full_vulnerability.sample
-- templates/full_vulnerability.template
-- templates/simple_port.fields
 - templates/simple_port.sample
-- templates/simple_port.template
 homepage: https://dradis.com/integrations/nexpose.html
 licenses:
 - GPL-2
@@ -172,7 +161,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.7
+rubygems_version: 3.1.4
 signing_key:
 specification_version: 4
 summary: Nexpose add-on for the Dradis Framework.

data/templates/full_evidence.fields

@@ -1,5 +0,0 @@
-evidence.id
-evidence.status
-evidence.content
-evidence.port
-evidence.protocol

data/templates/full_evidence.template

@@ -1,8 +0,0 @@
-#[ID]#
-%evidence.id%
-
-#[Status]#
-%evidence.status%
-
-#[Content]#
-%evidence.content%

data/templates/full_node.fields

@@ -1,10 +0,0 @@
-node.address
-node.device_id
-node.fingerprints
-node.hardware_address
-node.names
-node.tests
-node.risk_score
-node.site_name
-node.status
-node.software

data/templates/full_node.template

@@ -1,16 +0,0 @@
-#[Title]#
-%node.address%
-
-#[Hostname]#
-%node.site_name%
-
-#[Details]#
-Status: %node.status%
-Device id: %node.device_id%
-HW address: %node.hardware_address%
-
-#[Names]#
-%node.names%
-
-#[Software]#
-%node.software%

data/templates/full_scan.fields

@@ -1,5 +0,0 @@
-scan.end_time
-scan.name
-scan.scan_id
-scan.start_time
-scan.status

data/templates/full_scan.template

@@ -1,9 +0,0 @@
-#[Title]#
-%scan.name% (%scan.scan_id%)
-
-#[Timing]#
-Start time: %scan.start_time%
-End time: %scan.end_time%
-
-#[Status]#
-%scan.status%

data/templates/full_service.fields

@@ -1,4 +0,0 @@
-service.configurations
-service.fingerprints
-service.name
-service.tests

data/templates/full_service.template

@@ -1,11 +0,0 @@
-#[Title]#
-Service name: %service.name%
-
-#[Fingerprinting]#
-%service.fingerprints%
-
-#[Configuration]#
-%service.configurations%
-
-#[Tests]#
-%service.tests%

data/templates/full_vulnerability.fields

@@ -1,14 +0,0 @@
-vulnerability.added
-vulnerability.cvss_score
-vulnerability.cvss_vector
-vulnerability.description
-vulnerability.modified
-vulnerability.nexpose_id
-vulnerability.pci_severity
-vulnerability.published
-vulnerability.risk_score
-vulnerability.references
-vulnerability.severity
-vulnerability.solution
-vulnerability.tags
-vulnerability.title

data/templates/full_vulnerability.template

@@ -1,34 +0,0 @@
-#[Title]#
-%vulnerability.title%
-
-#[Nexpose Id]#
-%vulnerability.nexpose_id%
-
-#[Severity]#
-%vulnerability.severity%
-
-#[PCI Severity]#
-%vulnerability.pci_severity%
-
-#[CVSS Score]#
-%vulnerability.cvss_score%
-
-#[CVSS Vector]#
-%vulnerability.cvss_vector%
-
-#[Published]#
-%vulnerability.published%
-
-#[Description]#
-%vulnerability.description%
-
-
-#[Solution]#
-%vulnerability.solution%
-
-
-#[References]#
-%vulnerability.references%
-
-#[Tags]#
-%vulnerability.tags%

data/templates/simple_port.fields

@@ -1,2 +0,0 @@
-port.finding
-port.id

data/templates/simple_port.template

@@ -1,5 +0,0 @@
-#[Id]#
-%port.id%
-
-#[References]#
-%port.finding%