-
Notifications
You must be signed in to change notification settings - Fork 210
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add Known Exploited Vulnerabilities improver (#1422)
Add a Kev test & function docstrings Change the kev model ( known_ransomware_campaign_use from integer choices to boolean ) Add kev to api Access the vulnerability directly from Alias Add a tooltips and edit kev table Add a kev in a separate tab Solve migration conflict Add a basic improver squash migration files Add a basic Known Exploited Vulnerabilities model Signed-off-by: ziadhany <[email protected]>
- Loading branch information
Showing
8 changed files
with
361 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| import logging | ||
| from typing import Iterable | ||
|
|
||
| from django.db.models import QuerySet | ||
| from sphinx.util import requests | ||
|
|
||
| from vulnerabilities.improver import Improver | ||
| from vulnerabilities.improver import Inference | ||
| from vulnerabilities.models import Advisory | ||
| from vulnerabilities.models import Alias | ||
| from vulnerabilities.models import Kev | ||
|
|
||
| logger = logging.getLogger(__name__) | ||
|
|
||
|
|
||
| class VulnerabilityKevImprover(Improver): | ||
| """ | ||
| Known Exploited Vulnerabilities Improver | ||
| """ | ||
|
|
||
| @property | ||
| def interesting_advisories(self) -> QuerySet: | ||
| # TODO Modify KEV improver to iterate over the vulnerabilities alias, not the advisory | ||
| return [Advisory.objects.first()] | ||
|
|
||
| def get_inferences(self, advisory_data) -> Iterable[Inference]: | ||
| """ | ||
| Fetch Kev data, iterate over it to find the vulnerability with the specified alias, and create or update | ||
| the Kev instance accordingly. | ||
| """ | ||
|
|
||
| kev_url = ( | ||
| "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" | ||
| ) | ||
| response = requests.get(kev_url) | ||
| kev_data = response.json() | ||
| if response.status_code != 200: | ||
| logger.error( | ||
| f"Failed to fetch the CISA Catalog of Known Exploited Vulnerabilities: {kev_url}" | ||
| ) | ||
| return [] | ||
|
|
||
| for kev_vul in kev_data.get("vulnerabilities", []): | ||
| alias = Alias.objects.get_or_none(alias=kev_vul["cveID"]) | ||
| if not alias: | ||
| continue | ||
|
|
||
| vul = alias.vulnerability | ||
|
|
||
| if not vul: | ||
| continue | ||
|
|
||
| Kev.objects.update_or_create( | ||
| vulnerability=vul, | ||
| defaults={ | ||
| "description": kev_vul["shortDescription"], | ||
| "date_added": kev_vul["dateAdded"], | ||
| "required_action": kev_vul["requiredAction"], | ||
| "due_date": kev_vul["dueDate"], | ||
| "resources_and_notes": kev_vul["notes"], | ||
| "known_ransomware_campaign_use": True | ||
| if kev_vul["knownRansomwareCampaignUse"] == "Known" | ||
| else False, | ||
| }, | ||
| ) | ||
| return [] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,72 @@ | ||
| # Generated by Django 4.1.13 on 2024-05-29 19:14 | ||
|
|
||
| from django.db import migrations, models | ||
| import django.db.models.deletion | ||
|
|
||
|
|
||
| class Migration(migrations.Migration): | ||
|
|
||
| dependencies = [ | ||
| ("vulnerabilities", "0056_alter_packagechangelog_software_version_and_more"), | ||
| ] | ||
|
|
||
| operations = [ | ||
| migrations.CreateModel( | ||
| name="Kev", | ||
| fields=[ | ||
| ( | ||
| "id", | ||
| models.AutoField( | ||
| auto_created=True, primary_key=True, serialize=False, verbose_name="ID" | ||
| ), | ||
| ), | ||
| ( | ||
| "date_added", | ||
| models.DateField( | ||
| blank=True, | ||
| help_text="The date the vulnerability was added to the Known Exploited Vulnerabilities (KEV) catalog in the format YYYY-MM-DD.", | ||
| null=True, | ||
| ), | ||
| ), | ||
| ( | ||
| "description", | ||
| models.TextField( | ||
| help_text="Description of the vulnerability in the Known Exploited Vulnerabilities (KEV) catalog, usually a refinement of the original CVE description" | ||
| ), | ||
| ), | ||
| ( | ||
| "required_action", | ||
| models.TextField( | ||
| help_text="The required action to address the vulnerability, typically to apply vendor updates or apply vendor mitigations or to discontinue use." | ||
| ), | ||
| ), | ||
| ( | ||
| "due_date", | ||
| models.DateField( | ||
| help_text="The date the required action is due in the format YYYY-MM-DD,which applies to all USA federal civilian executive branch (FCEB) agencies,but all organizations are strongly encouraged to execute the required action." | ||
| ), | ||
| ), | ||
| ( | ||
| "resources_and_notes", | ||
| models.TextField( | ||
| help_text="Additional notes and resources about the vulnerability, often a URL to vendor instructions." | ||
| ), | ||
| ), | ||
| ( | ||
| "known_ransomware_campaign_use", | ||
| models.BooleanField( | ||
| default=False, | ||
| help_text="Known if this vulnerability is known to have been leveraged as part of a ransomware campaign; \n or 'Unknown' if CISA lacks confirmation that the vulnerability has been utilized for ransomware.", | ||
| ), | ||
| ), | ||
| ( | ||
| "vulnerability", | ||
| models.OneToOneField( | ||
| on_delete=django.db.models.deletion.CASCADE, | ||
| related_name="kev", | ||
| to="vulnerabilities.vulnerability", | ||
| ), | ||
| ), | ||
| ], | ||
| ), | ||
| ] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.