Skip to content

Commit

Permalink
Migrate ( metasploit, exploit-db, kev ) to aboutcode pipeline.
Browse files Browse the repository at this point in the history 
Set data_source as the header for the exploit table.
Squash the migration files into a single file.
Add test for exploit-db , metasploit
Add a missing migration file
Rename resources_and_notes to notes
Fix Api test
Refactor metasploit , exploitdb , kev improver
Rename Kev tab to exploit tab
Add support for exploitdb , metasploit, kev

Signed-off-by: ziadhany <[email protected]>
  • Loading branch information
@ziadhany
ziadhany committed Sep 11, 2024
1 parent b342145 commit 0446fff
Show file tree
Hide file tree
Showing 15 changed files with 750 additions and 158 deletions.
29 changes: 19 additions & 10 deletions vulnerabilities/api.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@
from rest_framework.throttling import UserRateThrottle

from vulnerabilities.models import Alias
from vulnerabilities.models import Kev
from vulnerabilities.models import Exploit
from vulnerabilities.models import Package
from vulnerabilities.models import Vulnerability
from vulnerabilities.models import VulnerabilityReference
Expand Down Expand Up @@ -175,10 +175,23 @@ def to_representation(self, instance):
return representation


class KEVSerializer(serializers.ModelSerializer):
class ExploitSerializer(serializers.ModelSerializer):
class Meta:
model = Kev
fields = ["date_added", "description", "required_action", "due_date", "resources_and_notes"]
model = Exploit
fields = [
"date_added",
"description",
"required_action",
"due_date",
"notes",
"known_ransomware_campaign_use",
"source_date_published",
"exploit_type",
"platform",
"source_date_updated",
"data_source",
"source_url",
]


class VulnerabilitySerializer(BaseResourceSerializer):
Expand All @@ -189,7 +202,7 @@ class VulnerabilitySerializer(BaseResourceSerializer):

references = VulnerabilityReferenceSerializer(many=True, source="vulnerabilityreference_set")
aliases = AliasSerializer(many=True, source="alias")
kev = KEVSerializer(read_only=True)
exploits = ExploitSerializer(many=True, read_only=True)
weaknesses = WeaknessSerializer(many=True)
severity_range_score = serializers.SerializerMethodField()

Expand All @@ -199,10 +212,6 @@ def to_representation(self, instance):
weaknesses = data.get("weaknesses", [])
data["weaknesses"] = [weakness for weakness in weaknesses if weakness is not None]

kev = data.get("kev", None)
if not kev:
data.pop("kev")

return data

def get_severity_range_score(self, instance):
Expand Down Expand Up @@ -240,7 +249,7 @@ class Meta:
"affected_packages",
"references",
"weaknesses",
"kev",
"exploits",
"severity_range_score",
]

Expand Down
8 changes: 6 additions & 2 deletions vulnerabilities/improvers/__init__.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,11 @@
#

from vulnerabilities.improvers import valid_versions
from vulnerabilities.improvers import vulnerability_kev
from vulnerabilities.improvers import vulnerability_status
from vulnerabilities.pipelines import exploitdb
from vulnerabilities.pipelines import flag_ghost_packages
from vulnerabilities.pipelines import metasploit
from vulnerabilities.pipelines import vulnerability_kev

IMPROVERS_REGISTRY = [
valid_versions.GitHubBasicImprover,
Expand All @@ -29,7 +31,9 @@
valid_versions.RubyImprover,
valid_versions.GithubOSVImprover,
vulnerability_status.VulnerabilityStatusImprover,
vulnerability_kev.VulnerabilityKevImprover,
vulnerability_kev.VulnerabilityKevPipeline,
metasploit.MetasploitImproverPipeline,
exploitdb.ExploitDBImproverPipeline,
flag_ghost_packages.FlagGhostPackagePipeline,
]

Expand Down
66 changes: 0 additions & 66 deletions vulnerabilities/improvers/vulnerability_kev.py
View file

This file was deleted.

131 changes: 131 additions & 0 deletions vulnerabilities/migrations/0063_exploit_delete_kev.py
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,131 @@
# Generated by Django 4.1.13 on 2024-09-10 18:40

from django.db import migrations, models
import django.db.models.deletion


class Migration(migrations.Migration):

dependencies = [
("vulnerabilities", "0062_package_is_ghost"),
]

operations = [
migrations.CreateModel(
name="Exploit",
fields=[
(
"id",
models.AutoField(
auto_created=True, primary_key=True, serialize=False, verbose_name="ID"
),
),
(
"date_added",
models.DateField(
blank=True,
help_text="The date the vulnerability was added to an exploit catalog.",
null=True,
),
),
(
"description",
models.TextField(
blank=True,
help_text="Description of the vulnerability in an exploit catalog, often a refinement of the original CVE description",
null=True,
),
),
(
"required_action",
models.TextField(
blank=True,
help_text="The required action to address the vulnerability, typically to apply vendor updates or apply vendor mitigations or to discontinue use.",
null=True,
),
),
(
"due_date",
models.DateField(
blank=True,
help_text="The date the required action is due, which applies to all USA federal civilian executive branch (FCEB) agencies, but all organizations are strongly encouraged to execute the required action",
null=True,
),
),
(
"notes",
models.TextField(
blank=True,
help_text="Additional notes and resources about the vulnerability, often a URL to vendor instructions.",
null=True,
),
),
(
"known_ransomware_campaign_use",
models.BooleanField(
default=False,
help_text="Known' if this vulnerability is known to have been leveraged as part of a ransomware campaign; \n or 'Unknown' if there is no confirmation that the vulnerability has been utilized for ransomware.",
),
),
(
"source_date_published",
models.DateField(
blank=True,
help_text="The date that the exploit was published or disclosed.",
null=True,
),
),
(
"exploit_type",
models.TextField(
blank=True,
help_text="The type of the exploit as provided by the original upstream data source.",
null=True,
),
),
(
"platform",
models.TextField(
blank=True,
help_text="The platform associated with the exploit as provided by the original upstream data source.",
null=True,
),
),
(
"source_date_updated",
models.DateField(
blank=True,
help_text="The date the exploit was updated in the original upstream data source.",
null=True,
),
),
(
"data_source",
models.TextField(
blank=True,
help_text="The source of the exploit information, such as CISA KEV, exploitdb, metaspoit, or others.",
null=True,
),
),
(
"source_url",
models.URLField(
blank=True,
help_text="The URL to the exploit as provided in the original upstream data source.",
null=True,
),
),
(
"vulnerability",
models.ForeignKey(
on_delete=django.db.models.deletion.CASCADE,
related_name="exploits",
to="vulnerabilities.vulnerability",
),
),
],
),
migrations.DeleteModel(
name="Kev",
),
]
73 changes: 57 additions & 16 deletions vulnerabilities/models.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1378,49 +1378,90 @@ def log_fixing(cls, package, importer, source_url, related_vulnerability):
)


class Kev(models.Model):
class Exploit(models.Model):
"""
Known Exploited Vulnerabilities
A vulnerability exploit is code used to
take advantage of a security flaw for unauthorized access or malicious activity.
"""

vulnerability = models.OneToOneField(
vulnerability = models.ForeignKey(
Vulnerability,
related_name="exploits",
on_delete=models.CASCADE,
related_name="kev",
)

date_added = models.DateField(
help_text="The date the vulnerability was added to the Known Exploited Vulnerabilities"
" (KEV) catalog in the format YYYY-MM-DD.",
null=True,
blank=True,
help_text="The date the vulnerability was added to an exploit catalog.",
)

description = models.TextField(
help_text="Description of the vulnerability in the Known Exploited Vulnerabilities"
" (KEV) catalog, usually a refinement of the original CVE description"
null=True,
blank=True,
help_text="Description of the vulnerability in an exploit catalog, often a refinement of the original CVE description",
)

required_action = models.TextField(
null=True,
blank=True,
help_text="The required action to address the vulnerability, typically to "
"apply vendor updates or apply vendor mitigations or to discontinue use."
"apply vendor updates or apply vendor mitigations or to discontinue use.",
)

due_date = models.DateField(
help_text="The date the required action is due in the format YYYY-MM-DD,"
"which applies to all USA federal civilian executive branch (FCEB) agencies,"
"but all organizations are strongly encouraged to execute the required action."
null=True,
blank=True,
help_text="The date the required action is due, which applies"
" to all USA federal civilian executive branch (FCEB) agencies, "
"but all organizations are strongly encouraged to execute the required action",
)

resources_and_notes = models.TextField(
notes = models.TextField(
null=True,
blank=True,
help_text="Additional notes and resources about the vulnerability,"
" often a URL to vendor instructions."
" often a URL to vendor instructions.",
)

known_ransomware_campaign_use = models.BooleanField(
default=False,
help_text="""Known if this vulnerability is known to have been leveraged as part of a ransomware campaign;
or 'Unknown' if CISA lacks confirmation that the vulnerability has been utilized for ransomware.""",
help_text="""Known' if this vulnerability is known to have been leveraged as part of a ransomware campaign;
or 'Unknown' if there is no confirmation that the vulnerability has been utilized for ransomware.""",
)

source_date_published = models.DateField(
null=True, blank=True, help_text="The date that the exploit was published or disclosed."
)

exploit_type = models.TextField(
null=True,
blank=True,
help_text="The type of the exploit as provided by the original upstream data source.",
)

platform = models.TextField(
null=True,
blank=True,
help_text="The platform associated with the exploit as provided by the original upstream data source.",
)

source_date_updated = models.DateField(
null=True,
blank=True,
help_text="The date the exploit was updated in the original upstream data source.",
)

data_source = models.TextField(
null=True,
blank=True,
help_text="The source of the exploit information, such as CISA KEV, exploitdb, metaspoit, or others.",
)

source_url = models.URLField(
null=True,
blank=True,
help_text="The URL to the exploit as provided in the original upstream data source.",
)

@property
Expand Down
Loading

0 comments on commit 0446fff

Please sign in to comment.