feat(ms): import gost:MaineK00n/new-windows (#1481)
* feat(ms): import gost:MaineK00n/new-windows * chore(discover): add CTI section * feat(ms): fill KB with VulnInfo.DistroAdvisories instead of CveContent.Optional * fix(ms): Change bitSize from 32 to 64 * fix(ms): delete KB prefix * chore(ms): change logger * fix(ms): fill in correct AdvisoryID Co-authored-by: Sadayuki Matsuno <sadayuki.matsuno@gmail.com>
This commit is contained in:
MaineK00n
@@ -4,9 +4,16 @@
|
||||
package gost
|
||||
|
||||
import (
|
||||
"sort"
|
||||
"fmt"
|
||||
"regexp"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
"golang.org/x/exp/maps"
|
||||
"golang.org/x/exp/slices"
|
||||
"golang.org/x/xerrors"
|
||||
|
||||
"github.com/future-architect/vuls/logging"
|
||||
"github.com/future-architect/vuls/models"
|
||||
gostmodels "github.com/vulsio/gost/models"
|
||||
)
|
||||
@@ -16,64 +23,160 @@ type Microsoft struct {
|
||||
Base
|
||||
}
|
||||
|
||||
var kbIDPattern = regexp.MustCompile(`KB(\d{6,7})`)
|
||||
|
||||
// DetectCVEs fills cve information that has in Gost
|
||||
func (ms Microsoft) DetectCVEs(r *models.ScanResult, _ bool) (nCVEs int, err error) {
|
||||
if ms.driver == nil {
|
||||
return 0, nil
|
||||
}
|
||||
cveIDs := []string{}
|
||||
for cveID := range r.ScannedCves {
|
||||
cveIDs = append(cveIDs, cveID)
|
||||
|
||||
var osName string
|
||||
osName, ok := r.Optional["OSName"].(string)
|
||||
if !ok {
|
||||
logging.Log.Warnf("This Windows has wrong type option(OSName). UUID: %s", r.ServerUUID)
|
||||
}
|
||||
msCves, err := ms.driver.GetMicrosoftMulti(cveIDs)
|
||||
|
||||
var products []string
|
||||
if _, ok := r.Optional["InstalledProducts"]; ok {
|
||||
switch ps := r.Optional["InstalledProducts"].(type) {
|
||||
case []interface{}:
|
||||
for _, p := range ps {
|
||||
pname, ok := p.(string)
|
||||
if !ok {
|
||||
logging.Log.Warnf("skip products: %v", p)
|
||||
continue
|
||||
}
|
||||
products = append(products, pname)
|
||||
}
|
||||
case []string:
|
||||
for _, p := range ps {
|
||||
products = append(products, p)
|
||||
}
|
||||
case nil:
|
||||
logging.Log.Warnf("This Windows has no option(InstalledProducts). UUID: %s", r.ServerUUID)
|
||||
}
|
||||
}
|
||||
|
||||
applied, unapplied := map[string]struct{}{}, map[string]struct{}{}
|
||||
if _, ok := r.Optional["KBID"]; ok {
|
||||
switch kbIDs := r.Optional["KBID"].(type) {
|
||||
case []interface{}:
|
||||
for _, kbID := range kbIDs {
|
||||
s, ok := kbID.(string)
|
||||
if !ok {
|
||||
logging.Log.Warnf("skip KBID: %v", kbID)
|
||||
continue
|
||||
}
|
||||
unapplied[strings.TrimPrefix(s, "KB")] = struct{}{}
|
||||
}
|
||||
case []string:
|
||||
for _, kbID := range kbIDs {
|
||||
unapplied[strings.TrimPrefix(kbID, "KB")] = struct{}{}
|
||||
}
|
||||
case nil:
|
||||
logging.Log.Warnf("This Windows has no option(KBID). UUID: %s", r.ServerUUID)
|
||||
}
|
||||
|
||||
for _, pkg := range r.Packages {
|
||||
matches := kbIDPattern.FindAllStringSubmatch(pkg.Name, -1)
|
||||
for _, match := range matches {
|
||||
applied[match[1]] = struct{}{}
|
||||
}
|
||||
}
|
||||
} else {
|
||||
switch kbIDs := r.Optional["AppliedKBID"].(type) {
|
||||
case []interface{}:
|
||||
for _, kbID := range kbIDs {
|
||||
s, ok := kbID.(string)
|
||||
if !ok {
|
||||
logging.Log.Warnf("skip KBID: %v", kbID)
|
||||
continue
|
||||
}
|
||||
applied[strings.TrimPrefix(s, "KB")] = struct{}{}
|
||||
}
|
||||
case []string:
|
||||
for _, kbID := range kbIDs {
|
||||
applied[strings.TrimPrefix(kbID, "KB")] = struct{}{}
|
||||
}
|
||||
case nil:
|
||||
logging.Log.Warnf("This Windows has no option(AppliedKBID). UUID: %s", r.ServerUUID)
|
||||
}
|
||||
|
||||
switch kbIDs := r.Optional["UnappliedKBID"].(type) {
|
||||
case []interface{}:
|
||||
for _, kbID := range kbIDs {
|
||||
s, ok := kbID.(string)
|
||||
if !ok {
|
||||
logging.Log.Warnf("skip KBID: %v", kbID)
|
||||
continue
|
||||
}
|
||||
unapplied[strings.TrimPrefix(s, "KB")] = struct{}{}
|
||||
}
|
||||
case []string:
|
||||
for _, kbID := range kbIDs {
|
||||
unapplied[strings.TrimPrefix(kbID, "KB")] = struct{}{}
|
||||
}
|
||||
case nil:
|
||||
logging.Log.Warnf("This Windows has no option(UnappliedKBID). UUID: %s", r.ServerUUID)
|
||||
}
|
||||
}
|
||||
|
||||
logging.Log.Debugf(`GetCvesByMicrosoftKBID query body {"osName": %s, "installedProducts": %q, "applied": %q, "unapplied: %q"}`, osName, products, maps.Keys(applied), maps.Keys(unapplied))
|
||||
cves, err := ms.driver.GetCvesByMicrosoftKBID(osName, products, maps.Keys(applied), maps.Keys(unapplied))
|
||||
if err != nil {
|
||||
return 0, nil
|
||||
return 0, xerrors.Errorf("Failed to detect CVEs. err: %w", err)
|
||||
}
|
||||
for cveID, msCve := range msCves {
|
||||
if _, ok := r.ScannedCves[cveID]; !ok {
|
||||
continue
|
||||
|
||||
for cveID, cve := range cves {
|
||||
cveCont, mitigations := ms.ConvertToModel(&cve)
|
||||
advisories := []models.DistroAdvisory{}
|
||||
for _, p := range cve.Products {
|
||||
for _, kb := range p.KBs {
|
||||
adv := models.DistroAdvisory{
|
||||
AdvisoryID: kb.Article,
|
||||
Description: "Microsoft Knowledge Base",
|
||||
}
|
||||
if _, err := strconv.Atoi(kb.Article); err == nil {
|
||||
adv.AdvisoryID = fmt.Sprintf("KB%s", kb.Article)
|
||||
}
|
||||
advisories = append(advisories, adv)
|
||||
}
|
||||
}
|
||||
cveCont, mitigations := ms.ConvertToModel(&msCve)
|
||||
v := r.ScannedCves[cveID]
|
||||
if v.CveContents == nil {
|
||||
v.CveContents = models.CveContents{}
|
||||
|
||||
r.ScannedCves[cveID] = models.VulnInfo{
|
||||
CveID: cveID,
|
||||
Confidences: models.Confidences{models.WindowsUpdateSearch},
|
||||
DistroAdvisories: advisories,
|
||||
CveContents: models.NewCveContents(*cveCont),
|
||||
Mitigations: mitigations,
|
||||
}
|
||||
v.CveContents[models.Microsoft] = []models.CveContent{*cveCont}
|
||||
v.Mitigations = append(v.Mitigations, mitigations...)
|
||||
r.ScannedCves[cveID] = v
|
||||
}
|
||||
return len(cveIDs), nil
|
||||
return len(cves), nil
|
||||
}
|
||||
|
||||
// ConvertToModel converts gost model to vuls model
|
||||
func (ms Microsoft) ConvertToModel(cve *gostmodels.MicrosoftCVE) (*models.CveContent, []models.Mitigation) {
|
||||
sort.Slice(cve.ScoreSets, func(i, j int) bool {
|
||||
return cve.ScoreSets[i].Vector < cve.ScoreSets[j].Vector
|
||||
slices.SortFunc(cve.Products, func(i, j gostmodels.MicrosoftProduct) bool {
|
||||
return i.ScoreSet.Vector < j.ScoreSet.Vector
|
||||
})
|
||||
|
||||
v3score := 0.0
|
||||
var v3Vector string
|
||||
for _, scoreSet := range cve.ScoreSets {
|
||||
if v3score < scoreSet.BaseScore {
|
||||
v3score = scoreSet.BaseScore
|
||||
v3Vector = scoreSet.Vector
|
||||
for _, p := range cve.Products {
|
||||
v, err := strconv.ParseFloat(p.ScoreSet.BaseScore, 64)
|
||||
if err != nil {
|
||||
continue
|
||||
}
|
||||
if v3score < v {
|
||||
v3score = v
|
||||
v3Vector = p.ScoreSet.Vector
|
||||
}
|
||||
}
|
||||
|
||||
var v3Severity string
|
||||
for _, s := range cve.Severity {
|
||||
v3Severity = s.Description
|
||||
}
|
||||
|
||||
var refs []models.Reference
|
||||
for _, r := range cve.References {
|
||||
if r.AttrType == "External" {
|
||||
refs = append(refs, models.Reference{Link: r.URL})
|
||||
}
|
||||
}
|
||||
|
||||
var cwe []string
|
||||
if 0 < len(cve.CWE) {
|
||||
cwe = []string{cve.CWE}
|
||||
for _, p := range cve.Products {
|
||||
v3Severity = p.Severity
|
||||
}
|
||||
|
||||
option := map[string]string{}
|
||||
@@ -82,28 +185,20 @@ func (ms Microsoft) ConvertToModel(cve *gostmodels.MicrosoftCVE) (*models.CveCon
|
||||
// "exploit_status": "Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely;DOS:N/A",
|
||||
option["exploit"] = cve.ExploitStatus
|
||||
}
|
||||
kbids := []string{}
|
||||
for _, kbid := range cve.KBIDs {
|
||||
kbids = append(kbids, kbid.KBID)
|
||||
}
|
||||
if 0 < len(kbids) {
|
||||
option["kbids"] = strings.Join(kbids, ",")
|
||||
}
|
||||
|
||||
vendorURL := "https://msrc.microsoft.com/update-guide/vulnerability/" + cve.CveID
|
||||
mitigations := []models.Mitigation{}
|
||||
if cve.Mitigation != "" {
|
||||
mitigations = append(mitigations, models.Mitigation{
|
||||
CveContentType: models.Microsoft,
|
||||
Mitigation: cve.Mitigation,
|
||||
URL: vendorURL,
|
||||
URL: cve.URL,
|
||||
})
|
||||
}
|
||||
if cve.Workaround != "" {
|
||||
mitigations = append(mitigations, models.Mitigation{
|
||||
CveContentType: models.Microsoft,
|
||||
Mitigation: cve.Workaround,
|
||||
URL: vendorURL,
|
||||
URL: cve.URL,
|
||||
})
|
||||
}
|
||||
|
||||
@@ -115,11 +210,9 @@ func (ms Microsoft) ConvertToModel(cve *gostmodels.MicrosoftCVE) (*models.CveCon
|
||||
Cvss3Score: v3score,
|
||||
Cvss3Vector: v3Vector,
|
||||
Cvss3Severity: v3Severity,
|
||||
References: refs,
|
||||
CweIDs: cwe,
|
||||
Published: cve.PublishDate,
|
||||
LastModified: cve.LastUpdateDate,
|
||||
SourceLink: vendorURL,
|
||||
SourceLink: cve.URL,
|
||||
Optional: option,
|
||||
}, mitigations
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user