misp-modules 2.4.196__py3-none-any.whl

misp_modules/modules/expansion/vulndb.py

@@ -0,0 +1,292 @@
+#!/usr/bin/env python3
+
+'''
+Import VulnDB
+    https://vulndb.cyberriskanalytics.com/
+    https://www.riskbasedsecurity.com/
+'''
+
+import oauth2 as oauth
+import json
+
+import logging
+import sys
+
+
+log = logging.getLogger('vulndb')
+log.setLevel(logging.DEBUG)
+ch = logging.StreamHandler(sys.stdout)
+ch.setLevel(logging.DEBUG)
+formatter = logging.Formatter('%(asctime)s - %(name)s - %(levelname)s - %(message)s')
+ch.setFormatter(formatter)
+log.addHandler(ch)
+
+
+misperrors = {'error': 'Error'}
+mispattributes = {
+    'input': ['vulnerability'],
+    'output': ['text', 'link', 'cpe']}
+moduleinfo = {
+    'version': '0.1',
+    'author': 'Koen Van Impe',
+    'description': 'Module to query VulnDB (RiskBasedSecurity.com).',
+    'module-type': ['expansion', 'hover'],
+    'name': 'VulnDB Lookup',
+    'logo': 'vulndb.png',
+    'requirements': ['An access to the VulnDB API (apikey, apisecret)'],
+    'features': 'This module takes a vulnerability attribute as input and queries VulnDB in order to get some additional data about it.\n\nThe API gives the result of the query which can be displayed in the screen, and/or mapped into MISP attributes to add in the event.',
+    'references': ['https://vulndb.cyberriskanalytics.com/'],
+    'input': 'A vulnerability attribute.',
+    'output': 'Additional data enriching the CVE input, fetched from VulnDB.',
+}
+
+moduleconfig = ['apikey', 'apisecret', 'discard_dates', 'discard_external_references', 'discard_cvss', 'discard_productinformation', 'discard_classification', 'discard_cpe']
+
+
+def handler(q=False):
+    # Base URL for VulnDB
+    VULNDB_URL = "https://vulndb.cyberriskanalytics.com"
+
+    if q is False:
+        return False
+    request = json.loads(q)
+
+    # Only continue if we have a vulnerability attribute
+    if not request.get('vulnerability'):
+        misperrors['error'] = 'Vulnerability ID missing for VulnDB.'
+        return misperrors
+    vulnerability = request.get('vulnerability')
+
+    if request["config"].get("apikey") is None or request["config"].get("apisecret") is None:
+        misperrors["error"] = "Missing API key or secret value for VulnDB."
+        return misperrors
+    apikey = request["config"].get("apikey")
+    apisecret = request["config"].get("apisecret")
+
+    # This has to be done the 'inverse' way, MISP-server settings are set to False by default
+    add_cvss = True
+    add_products = True
+    add_classifications = True
+    add_cpe = True
+    add_dates = True
+    add_ext_references = True
+
+    if request["config"].get("discard_dates") is not None and request["config"].get("discard_dates").lower() == "true":
+        add_dates = False
+    if request["config"].get("discard_external_references") is not None and request["config"].get("discard_external_references").lower() == "true":
+        add_ext_references = False
+    if request["config"].get("discard_cvss") is not None and request["config"].get("discard_cvss").lower() == "true":
+        add_cvss = False
+    if request["config"].get("discard_productinformation") is not None and request["config"].get("discard_productinformation").lower() == "true":
+        add_products = False
+    if request["config"].get("discard_classification") is not None and request["config"].get("discard_classification").lower() == "true":
+        add_classifications = False
+    if request["config"].get("discard_cpe") is not None and request["config"].get("discard_cpe").lower() == "true":
+        add_cpe = False
+
+    cpu_vulndb = ""
+    if add_cpe:
+        cpu_vulndb = "?show_cpe=true"
+
+    find_by_cve_url = "%s/api/v1/vulnerabilities/%s/find_by_cve_id%s" % (VULNDB_URL, vulnerability, cpu_vulndb)
+    log.debug(find_by_cve_url)
+
+    try:
+
+        consumer = oauth.Consumer(key=apikey, secret=apisecret)
+        client = oauth.Client(consumer)
+        resp, content = client.request(find_by_cve_url, "GET")
+        content_json = json.loads(content.decode())
+
+        if content_json:
+            if 'error' in content_json:
+                misperrors["error"] = "No CVE information found."
+                return misperrors
+            else:
+                output = {'results': list()}
+                values_text = list()
+                values_links = list()
+                values_cpe = list()
+
+                results = content_json["results"][0]
+
+                # Include the VulnDB title and ID
+                values_text.append(results["title"])
+                vulndb_id_link = "%s/vulnerabilities/%s" % (VULNDB_URL, results["vulndb_id"])
+                values_links.append(vulndb_id_link)
+
+                # Descriptive part of the VulnDB item
+                description = results.get('description', '') or ''
+                keywords = results.get('keywords', '') or ''
+                solution = results.get('solution', '') or ''
+                manual_notes = results.get('manual_notes', '') or ''
+                t_description = results.get('t_description', '') or ''
+                if description:
+                    values_text.append(description)
+                if t_description:
+                    values_text.append(t_description)
+                if manual_notes:
+                    values_text.append("Notes: " + manual_notes)
+                if keywords:
+                    values_text.append("Keywords: " + keywords)
+                if solution:
+                    values_text.append("Solution: " + solution)
+
+                # VulnDB items contain a number of dates, do we include them?
+                if add_dates:
+                    log.debug("Include dates")
+                    solution_date = results.get('solution_date', '') or ''
+                    if solution_date:
+                        values_text.append("Solution date: " + solution_date)
+                    disclosure_date = results.get('disclosure_date', '') or ''
+                    if disclosure_date:
+                        values_text.append("Disclosure date: " + disclosure_date)
+                    discovery_date = results.get('discovery_date', '') or ''
+                    if discovery_date:
+                        values_text.append("Discovery date: " + discovery_date)
+                    exploit_publish_date = results.get('exploit_publish_date', '') or ''
+                    if exploit_publish_date:
+                        values_text.append("Exploit published date: " + exploit_publish_date)
+                    vendor_informed_date = results.get('vendor_informed_date', '') or ''
+                    if vendor_informed_date:
+                        values_text.append("Vendor informed date: " + vendor_informed_date)
+                    vendor_ack_date = results.get('vendor_ack_date', '') or ''
+                    if vendor_ack_date:
+                        values_text.append("Vendor acknowledgement date: " + vendor_ack_date)
+                    third_party_solution_date = results.get('third_party_solution_date', '') or ''
+                    if third_party_solution_date:
+                        values_text.append("Third party solution date: " + third_party_solution_date)
+
+                # External references
+                if add_ext_references:
+                    ext_references = results.get('ext_references')
+                    if ext_references:
+                        log.debug("Include external references")
+                        for reference in ext_references:
+                            reference_type = reference["type"]
+                            if reference_type == "Other Advisory URL":
+                                values_links.append(reference["value"])
+                            elif reference_type == "News Article":
+                                values_links.append(reference["value"])
+                            elif reference_type == "Generic Informational URL":
+                                values_links.append(reference["value"])
+                            elif reference_type == "Vendor Specific Advisory URL":
+                                values_links.append(reference["value"])
+                            elif reference_type == "Vendor URL":
+                                values_links.append(reference["value"])
+                            elif reference_type == "Mail List Post":
+                                values_links.append(reference["value"])
+                            elif reference_type == "Metasploit URL":
+                                values_links.append(reference["value"])
+                            elif reference_type == "Packet Storm":
+                                values_links.append(reference["value"])
+                            elif reference_type == "Generic Exploit URL":
+                                values_links.append(reference["value"])
+                            elif reference_type == "CERT VU":
+                                reference_link = "http://www.kb.cert.org/vuls/id/%s" % reference["value"]
+                                values_links.append(reference_link)
+                            elif reference_type == "CVE ID":
+                                reference_link = "https://nvd.nist.gov/vuln/detail/%s" % reference["value"]
+                                values_links.append(reference_link)
+                            elif reference_type == "Microsoft Knowledge Base Article":
+                                reference_link = "https://support.microsoft.com/en-us/help/%s" % reference["value"]
+                                values_links.append(reference_link)
+                            elif reference_type == "Exploit Database":
+                                reference_link = "https://www.exploit-db.com/exploits/%s" % reference["value"]
+                                values_links.append(reference_link)
+                            elif reference_type == "Generic Informational URL":
+                                values_links.append(reference["value"])
+                            elif reference_type == "Generic Informational URL":
+                                values_links.append(reference["value"])
+                            elif reference_type == "Generic Informational URL":
+                                values_links.append(reference["value"])
+                            elif reference_type == "Generic Informational URL":
+                                values_links.append(reference["value"])
+                            elif reference_type == "Generic Informational URL":
+                                values_links.append(reference["value"])
+
+                # CVSS Scoring
+                if add_cvss:
+                    cvss = results.get('cvss_metrics')
+                    if cvss:
+                        log.debug("Include CVSS")
+                        for cvss_metric in cvss:
+                            score = cvss_metric.get("score")
+                            if score:
+                                values_text.append("CVSS %s (base: %s) (source: %s)" % (score, cvss_metric.get("calculated_cvss_base_score"), cvss_metric.get("source")))
+
+                # Add products
+                if add_products:
+                    products = results.get('products')
+                    if products and len(products) > 0:
+
+                        # Get the vendors
+                        vendors = results.get('vendors')
+                        vendors_name = ""
+                        log.debug("Include product information")
+                        if vendors:
+                            for vendor in vendors:
+                                vendor_detail = vendor.get("vendor")
+                                if vendor_detail:
+                                    vendor_name = vendor_detail.get("name")
+                                    if vendor_name:
+                                        vendors_name += vendor_name + " "
+
+                        # Walk through all vendors
+                        for product in products:
+                            vulnerable_product = vendors_name
+                            name = product.get("name")
+                            if name:
+                                vulnerable_product += "%s " % name
+                            versions = product.get("versions")
+                            if versions:
+                                vulnerable_product += "("
+                                for version in versions:
+                                    affected = version.get("affected")
+
+                                    if affected and affected == "true":
+                                        vulnerable_product += " %s " % version.get("name")
+                                    if add_cpe:
+                                        version_cpe = version.get("cpe")
+                                        if version_cpe:
+                                            cpe = version_cpe[0].get("cpe")
+                                            if cpe:
+                                                values_cpe.append(cpe)
+
+                                vulnerable_product += ")"
+                            # Add vulnerable products
+                            values_text.append(vulnerable_product)
+
+                # Add vulnerability classifications
+                if add_classifications:
+                    classifications = results.get("classifications")
+                    if classifications and len(classifications) > 0:
+                        vulnerability_classification = ""
+                        log.debug("Include classifications")
+                        for classification in classifications:
+                            longname = classification.get("longname")
+                            description = classification.get("description")
+                            vulnerability_classification += " \"%s\" " % longname
+                        values_text.append(vulnerability_classification)
+
+                # Finished processing the VulnDB reply; set the result for MISP
+                output['results'] += [{'types': 'text', 'values': values_text}]
+                output['results'] += [{'types': 'link', 'values': values_links}]
+                if add_cpe:
+                    output['results'] += [{'types': 'cpe', 'values': values_cpe}]
+                return output
+        else:
+            misperrors["error"] = "No information retrieved from VulnDB."
+            return misperrors
+    except Exception:
+        misperrors["error"] = "Error while fetching information from VulnDB, wrong API keys?"
+        return misperrors
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    moduleinfo['config'] = moduleconfig
+    return moduleinfo

misp_modules/modules/expansion/vulnerability_lookup.py

@@ -0,0 +1,324 @@
+import json
+import requests
+from . import check_input_attribute, standard_error_message
+from ._vulnerability_parser.vulnerability_parser import (
+    VulnerabilityMapping, VulnerabilityParser)
+from pymisp import MISPObject
+from typing import Iterator
+
+misperrors = {'error': 'Error'}
+mispattributes = {'input': ['vulnerability'], 'format': 'misp_standard'}
+moduleinfo = {
+    'version': '1',
+    'author': 'Christian Studer',
+    'description': 'An expansion module to query Vulnerability Lookup',
+    'module-type': ['expansion', 'hover'],
+    'name': 'Vulnerability Lookup',
+    'logo': '',
+    'requirements': [],
+    'features': '',
+    'references': [],
+    'input': '',
+    'output': '',
+}
+api_url = 'https://vulnerability.circl.lu'
+
+
+class VulnerabilityLookupMapping(VulnerabilityMapping):
+    __csaf_mapping = {
+        'id': 'id',
+        'initial_release_date': 'published',
+        'current_release_date': 'modified'
+    }
+    __cve_mapping = {
+        'cveId': 'id',
+        'datePublished': 'published',
+        'dateUpdated': 'modified',
+        'state': 'state'
+    }
+    __gsd_mapping = {
+        'id': 'id',
+        'details': 'description',
+        'modified': 'modified'
+    }
+    __nvd_mapping = {
+        'id': 'id',
+        'published': 'published',
+        'lastModified': 'modified'
+    }
+    __ossf_mapping = {
+        'id': 'id',
+        'summary': 'summary',
+        'details': 'description',
+        'published': 'published',
+        'modified': 'modified'
+    }
+    __related_vuln_mapping = {
+        'cve': 'id',
+        'title': 'summary',
+        'discovery_date': 'published'
+    }
+    __source_mapping = {
+        'cve': '_parse_cve_description',
+        'ghsa': '_parse_standard_description',
+        'gsd': '_parse_gsd_description',
+        'mal': '_parse_ossf_description',
+        'pysec': '_parse_standard_description',
+        'var': '_parse_variot_description'
+    }
+    __source_mapping.update(
+        dict.fromkeys(
+            (
+                'cisco', 'icsa', 'icsma', 'nn', 'oxas',
+                'rhba', 'rhea', 'rhsa', 'sca', 'ssa', 'wid'
+            ),
+            '_parse_csaf_description'
+        )
+    )
+    __standard_mapping = {
+        'id': 'id',
+        'details': 'description',
+        'published': 'published',
+        'modified': 'modified'
+    }
+
+    @classmethod
+    def csaf_mapping(cls) -> dict:
+        return cls.__csaf_mapping
+
+    @classmethod
+    def cve_mapping(cls) -> dict:
+        return cls.__cve_mapping
+
+    @classmethod
+    def gsd_mapping(cls) -> dict:
+        return cls.__gsd_mapping
+
+    @classmethod
+    def nvd_mapping(cls) -> dict:
+        return cls.__nvd_mapping
+
+    @classmethod
+    def ossf_mapping(cls) -> dict:
+        return cls.__ossf_mapping
+
+    @classmethod
+    def related_vuln_mapping(cls) -> dict:
+        return cls.__related_vuln_mapping
+
+    @classmethod
+    def source_mapping(cls, field: str) -> str:
+        return cls.__source_mapping.get(field)
+
+    @classmethod
+    def standard_mapping(cls) -> dict:
+        return cls.__standard_mapping
+
+
+class VulnerabilityLookupParser(VulnerabilityParser):
+    def __init__(self, attribute: dict):
+        super().__init__(attribute)
+        self.__mapping = VulnerabilityLookupMapping
+        self.__errors = []
+
+    @property
+    def errors(self) -> list:
+        return self.__errors
+
+    @property
+    def mapping(self) -> VulnerabilityLookupMapping:
+        return self.__mapping
+
+    def parse_lookup_result(self, lookup_result: dict):
+        feature = self.mapping.source_mapping(
+            self.misp_attribute.value.split('-')[0].lower()
+        )
+        getattr(self, feature)(lookup_result)
+
+    def _parse_aliases(self, aliases: list) -> Iterator[str]:
+        for alias in aliases:
+            query = requests.get(f"{api_url}/vulnerability/{alias}")
+            if query.status_code != 200:
+                self.errors.append(
+                    f'Unable to query related vulnerability id {alias}'
+                )
+                continue
+            vulnerability = query.json()
+            if not vulnerability:
+                self.errors.append(
+                    f'No results for related vulnerability id{alias}'
+                )
+                continue
+            feature = self.mapping.source_mapping(alias.split('-')[0].lower())
+            yield getattr(self, feature)(vulnerability)
+
+    def _parse_csaf_description(self, lookup_result: dict) -> str:
+        description = lookup_result['document']
+
+        tracking = description['tracking']
+        misp_object = MISPObject('vulnerability')
+        for field, relation in self.mapping.csaf_mapping().items():
+            misp_object.add_attribute(relation, tracking[field])
+        misp_object.add_attribute('summary', description['title'])
+        for reference in description.get('references', []):
+            misp_object.add_attribute('references', reference['url'])
+        misp_object.add_attribute('credit', description['publisher']['name'])
+        misp_object.add_reference(self.misp_attribute.uuid, 'describes')
+        vulnerability_object = self.misp_event.add_object(misp_object)
+
+        for vulnerability in lookup_result['vulnerabilities']:
+            related = MISPObject('vulnerability')
+            for field, relation in self.mapping.related_vuln_mapping().items():
+                if vulnerability.get(field):
+                    related.add_attribute(relation, vulnerability[field])
+            for score in vulnerability.get('scores', []):
+                cvss_v3 = score['cvss_v3']
+                related.add_attribute('cvss-score', cvss_v3['baseScore'])
+                related.add_attribute('cvss-string', cvss_v3['vectorString'])
+            for reference in vulnerability.get('references', []):
+                related.add_attribute('references', reference['url'])
+            related.add_reference(vulnerability_object.uuid, 'related-to')
+            related_vulnerability = self.misp_event.add_object(related)
+            if vulnerability.get('cwe'):
+                cwe = vulnerability['cwe']
+                weakness = MISPObject('weakness')
+                for field, value in cwe.items():
+                    weakness.add_attribute(field, value)
+                weakness.add_reference(related_vulnerability.uuid, 'leads-to')
+                self.misp_event.add_object(weakness)
+
+        return vulnerability_object.uuid
+
+    def _parse_cve_description(self, lookup_result: dict) -> str:
+        misp_object = MISPObject('vulnerability')
+        cveMetaData = lookup_result['cveMetadata']
+        for field, relation in self.mapping.cve_mapping().items():
+            misp_object.add_attribute(relation, cveMetaData[field])
+        for reference in lookup_result['containers']['cna']['references']:
+            misp_object.add_attribute('references', reference['url'])
+        misp_object.add_reference(self.misp_attribute.uuid, 'related-to')
+        vulnerability_object = self.misp_event.add_object(misp_object)
+        return vulnerability_object.uuid
+
+    def _parse_cve_related_description(self, cve_description: dict) -> str:
+        misp_object = MISPObject('vulnerability')
+        misp_object.add_attribute(
+            'id', cve_description['CVE_data_meta']['ID']
+        )
+        misp_object.add_attribute(
+            'description',
+            cve_description['description']['description_data'][0]['value']
+        )
+        for cvss in cve_description.get('impact', {}).get('cvss', []):
+            misp_object.add_attribute('cvss-score', cvss['baseScore'])
+            misp_object.add_attribute('cvss-string', cvss['vectorString'])
+        for reference in misp_object.get('references', {}).get('reference_data', []):
+            misp_object.add_attribute('references', reference['url'])
+        return self.misp_event.add_object(misp_object).uuid
+
+    def _parse_gsd_description(self, lookup_result: dict) -> str:
+        misp_object = MISPObject('vulnerability')
+        gsd_details = lookup_result['gsd']['osvSchema']
+        for field, relation in self.mapping.gsd_mapping().items():
+            misp_object.add_attribute(relation, gsd_details[field])
+        misp_object.add_reference(self.misp_attribute.uuid, 'related-to')
+        vulnerability_object = self.misp_event.add_object(misp_object)
+
+        for field, values in lookup_result['namespaces'].items():
+            if field == 'cve.org':
+                vulnerability_object.add_reference(
+                    self._parse_cve_related_description(values), 'related-to'
+                )
+                continue
+            if field == 'nvd.nist.gov' and values.get('cve'):
+                vulnerability_object.add_reference(
+                    self._parse_nvd_related_description(values['cve']),
+                    'related-to'
+                )
+
+        return vulnerability_object.uuid
+
+    def _parse_nvd_related_description(self, nvd_description: dict) -> str:
+        misp_object = MISPObject('vulnerability')
+        for field, relation in self.mapping.nvd_mapping().items():
+            misp_object.add_attribute(relation, nvd_description[field])
+        misp_object.add_attribute(
+            'description', nvd_description['descriptions'][0]['value']
+        )
+        for cvss in nvd_description.get('metrics', {}).get('cvssMetricV31', []):
+            misp_object.add_attribute(
+                'cvss-score', cvss['cvssData']['baseScore']
+            )
+            misp_object.add_attribute(
+                'cvss-string', cvss['cvssData']['vectorString']
+            )
+        for reference in nvd_description.get('references', []):
+            misp_object.add_attribute('references', reference['url'])
+        return self.misp_event.add_object(misp_object).uuid
+
+    def _parse_ossf_description(self, lookup_result: dict) -> str:
+        misp_object = MISPObject('vulnerability')
+        for field, relation in self.mapping.ossf_mapping().items():
+            misp_object.add_attribute(relation, lookup_result[field])
+        for reference in lookup_result['references']:
+            misp_object.add_attribute('references', reference['url'])
+        misp_object.add_reference(self.misp_attribute.uuid, 'related-to')
+        vulnerability_object = self.misp_event.add_object(misp_object)
+
+        if lookup_result.get('aliases'):
+            for vuln_uuid in self._parse_aliases(lookup_result['aliases']):
+                vulnerability_object.add_reference(vuln_uuid, 'related-to')
+
+        return vulnerability_object.uuid
+
+    def _parse_standard_description(self, lookup_result: dict) -> str:
+        misp_object = MISPObject('vulnerability')
+        for field, relation in self.mapping.standard_mapping().items():
+            misp_object.add_attribute(relation, lookup_result[field])
+        for cvss in lookup_result.get('severity', []):
+            misp_object.add_attribute('cvss-string', cvss['score'])
+        for reference in lookup_result['references']:
+            misp_object.add_attribute('references', reference['url'])
+        misp_object.add_reference(self.misp_attribute.uuid, 'related-to')
+        vulnerability_object = self.misp_event.add_object(misp_object)
+
+        if lookup_result.get('aliases'):
+            for vuln_uuid in self._parse_aliases(lookup_result['aliases']):
+                vulnerability_object.add_reference(vuln_uuid, 'related-to')
+
+        return vulnerability_object.uuid
+
+
+def handler(q=False):
+    if q is False:
+        return q
+    request = json.loads(q)
+    if not check_input_attribute(request.get('attribute', {})):
+       return {
+           'error': f'{standard_error_message}, which should contain '
+                    'at least a type, a value and an UUID.'
+        }
+    attribute = request['attribute']
+    if attribute.get('type') != 'vulnerability':
+        misperrors['error'] = 'Vulnerability ID missing'
+        return misperrors
+    lookup = requests.get(f"{api_url}/vulnerability/{attribute['value']}")
+    if lookup.status_code == 200:
+        vulnerability = lookup.json()
+        if not vulnerability:
+            misperrors['error'] = 'Non existing Vulnerability ID.'
+            return misperrors
+    else:
+        misperrors['error'] = 'Vulnerability Lookup API not accessible.'
+        return misperrors
+    parser = VulnerabilityLookupParser(attribute)
+    parser.parse_lookup_result(vulnerability)
+    return parser.get_results()
+
+
+def introspection():
+    return mispattributes
+
+
+def version():
+    return moduleinfo