CVE Search v2 Deprecated

Deprecated. Use CIRCL CVE Search instead.

Vulnerability Management · CVE Search (Deprecated)

Details

IDCVE Search v2
ProviderOpen Source
CategoryVulnerability Management
From Version5.0.0
Docker Imagedemisto/python3:3.10.12.63474
Supported ModulesAgentix

README

Overview

Search CVE Information - powered by circl.lu
This integration was integrated and tested with CVE Search (Version 2.1).

Use Cases

  1. Getting information about a specific cve
  2. Getting the latest published cve’s

Configure CVE Search on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for CVE Search v2.
  3. Click Add instance to create and configure a new integration instance.
    • Name: a textual name for the integration instance.
    • Server URL
  4. Click Test to validate the URLs and connection.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

  1. cve-latest
  2. cve

1. cve-latest

Retruns the latest updated CVEs.

Base Command

cve-latest

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output
Path Type Description
CVE.ID String The ID of the CVE.
CVE.CVSS String The CVSS score of the CVE.
CVE.Published Date The date the CVE was published.
CVE.Modified Date When CVE was last modified.
CVE.Description String The description of the CVE.
DBotScore.Indicator String The indicator value.
DBotScore.Score Number The indicator score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor reporting the score of the indicator.
Command Example

!cve-latest limit=2

Context Example
{
    "CVE": [
        {
            "ID": "CVE-2020-7998", 
            "Published": "2020-01-28T05:15:00", 
            "CVSS": 5, 
            "Modified": "2020-01-28T05:15:00", 
            "Description": "An arbitrary file upload vulnerability has been discovered in the Super File Explorer app 1.0.1 for iOS. The vulnerability is located in the developer path that is accessible and hidden next to the root path. By default, there is no password set for the FTP or Web UI service."
        }, 
        {
            "ID": "CVE-2020-7997", 
            "Published": "2020-01-28T05:15:00", 
            "CVSS": 5, 
            "Modified": "2020-01-28T05:15:00", 
            "Description": "ASUS WRT-AC66U 3 RT 3.0.0.4.372_67 devices allow XSS via the Client Name field to the Parental Control feature."
        }, 
    ]
}
Human Readable Output

Integration log: {‘CVE(val.ID === obj.ID)’: [{‘ID’: ‘CVE-2020-7998’, ‘CVSS’: 5.0, ‘Published’: ‘2020-01-28T05:15:00’, ‘Modified’: ‘2020-01-28T05:15:00’, ‘Description’: ‘An arbitrary file upload vulnerability has been discovered in the Super File Explorer app 1.0.1 for iOS. The vulnerability is located in the developer path that is accessible and hidden next to the root path. By default, there is no password set for the FTP or Web UI service.’}, {‘ID’: ‘CVE-2020-7997’, ‘CVSS’: 5.0, ‘Published’: ‘2020-01-28T05:15:00’, ‘Modified’: ‘2020-01-28T05:15:00’, ‘Description’: ‘ASUS WRT-AC66U 3 RT 3.0.0.4.372_67 devices allow XSS via the Client Name field to the Parental Control feature.’}]}

cicle.lu Latest CVEs

CVSS Description ID Modified Published
5.0 An arbitrary file upload vulnerability has been discovered in the Super File Explorer app 1.0.1 for iOS. The vulnerability is located in the developer path that is accessible and hidden next to the root path. By default, there is no password set for the FTP or Web UI service. CVE-2020-7998 2020-01-28T05:15:00 2020-01-28T05:15:00
5.0 ASUS WRT-AC66U 3 RT 3.0.0.4.372_67 devices allow XSS via the Client Name field to the Parental Control feature. CVE-2020-7997 2020-01-28T05:15:00 2020-01-28T05:15:00

2. cve

Search CVE by ID

Base Command

cve

Input
Argument Name Description Required
cve_id A comma separated list of CVE IDs to search. Required
Context Output
Path Type Description
CVE.ID String The ID of the CVE.
CVE.CVSS String The CVSS score of the CVE.
CVE.Published Date The date the CVE was published.
CVE.Modified Date The date the CVE was last modified.
CVE.Description String The description of the CVE.
DBotScore.Indicator String The indicator value.
DBotScore.Score Number The indicator score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor reporting the score of the indicator.
Command Example

!cve cve_id=CVE-2014-1234

Context Example
{
    "CVE": [
        {
            "ID": "CVE-2014-1234", 
            "Published": "2014-01-10T12:02:00", 
            "CVSS": 2.1, 
            "Modified": "2014-01-10T17:57:00", 
            "Description": "The paratrooper-newrelic gem 1.0.1 for Ruby allows local users to obtain the X-Api-Key value by listing the curl process."
        }
    ]
}
Human Readable Output

Integration log: {‘CVE(val.ID === obj.ID)’: [{‘ID’: ‘CVE-2014-1234’, ‘CVSS’: 2.1, ‘Published’: ‘2014-01-10T12:02:00’, ‘Modified’: ‘2014-01-10T17:57:00’, ‘Description’: ‘The paratrooper-newrelic gem 1.0.1 for Ruby allows local users to obtain the X-Api-Key value by listing the curl process.’}]}

CVE Search results

CVSS Description ID Modified Published
2.1 The paratrooper-newrelic gem 1.0.1 for Ruby allows local users to obtain the X-Api-Key value by listing the curl process. CVE-2014-1234 2014-01-10T17:57:00 2014-01-10T12:02:00

Configuration parameters

  • url — Server URL (required)
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)

Commands (2)

  • cve

    Returns CVE information by CVE ID.

  • cve-latest

    Returns the latest updated CVEs.

Source

CVESearchV2.py CVESearchV2_test.py CVESearchV2.yml CVESearchV2_description.md
Download History Raw 
import json
import os
from CVESearchV2 import cve_command, valid_cve_id_format, Client
from CommonServerPython import DemistoException, argToList
import pytest

BASE_URL = 'https://cve.circl.lu/api/'


def test_wrong_path():
    bad_url = 'https://cve.bad_url'
    client = Client(base_url=bad_url)
    try:
        cve_command(client, {"cve_id": 'cve-2000-1234'})
        assert False, 'Bad url- Exception should by raised'
    except DemistoException as err:
        expected_exception_message = 'Verify that the server URL parameter is correct'
        assert expected_exception_message in str(err), 'Bad error response when bad url is given'


def test_bad_cve_id():
    bad_cve_id = 'CVE-bad-cve'
    client = Client(base_url=BASE_URL)
    try:
        cve_command(client, {'cve_id': bad_cve_id})
        assert False, 'Bad url- Exception should by raised'
    except DemistoException as e:
        assert str(e) == f'"{bad_cve_id}" is not a valid cve ID'


def test_cve_id_validation():
    test_cases = [('cve-2000-1234', True),
                  ('CVE-2000-1234', True),
                  ('sdfsdf', False),
                  ('cve-2000-01111', False),
                  ('cve-2000-0111', True),
                  ('2014-1111', False)]
    for cve_id, is_valid in test_cases:
        assert valid_cve_id_format(cve_id) == is_valid, \
            f'validation results for {cve_id}: {valid_cve_id_format(cve_id)} != {is_valid}'


test_data = [
    ({"cve_id": "cve-2000-1234,CVE-2020-155555"}, ['response.json', 'empty_response.json'], 2),
    ({"cve_id": "cve-2000-1234"}, ['response.json'], 1),
]


@pytest.mark.parametrize("cve_id_arg,response_data,expected", test_data)
def test_multiple_cve(cve_id_arg, response_data, expected, requests_mock):
    """
    Given:
        a multiple or single CVE to fetch.

    When:
        cve_command is being called.

    Then:
        return a List of commandResults - each item representing a CVE.
    """
    cves = argToList(cve_id_arg.get('cve_id'))
    for test_file, cve in zip(response_data, cves):
        test_path_data = os.path.join(os.getcwd(), 'test_data', test_file)
        with open(test_path_data) as js:
            response = json.load(js)
        url_for_mock = os.path.join('https://cve.circl.lu/api/cve', cve)
        requests_mock.get(url_for_mock, json=response)
    client = Client(base_url=BASE_URL)
    command_results = cve_command(client, cve_id_arg)
    assert len(command_results) == expected