feat(detector/cve): new support for fortinet data feed (#1736)

future-architect · Sep 25, 2023 · 78b52d6 · 78b52d6
1 parent 048e204
commit 78b52d6
Show file tree

Hide file tree

Showing 9 changed files with 186 additions and 97 deletions.
diff --git a/detector/cve_client.go b/detector/cve_client.go
@@ -163,15 +163,15 @@ func (client goCveDictClient) detectCveByCpeURI(cpeURI string, useJVN bool) (cve
 		return cves, nil
 	}
 
-	nvdCves := []cvemodels.CveDetail{}
+	filtered := []cvemodels.CveDetail{}
 	for _, cve := range cves {
-		if !cve.HasNvd() {
+		if !cve.HasNvd() && !cve.HasFortinet() {
 			continue
 		}
 		cve.Jvns = []cvemodels.Jvn{}
-		nvdCves = append(nvdCves, cve)
+		filtered = append(filtered, cve)
 	}
-	return nvdCves, nil
+	return filtered, nil
 }
 
 func httpPost(url string, query map[string]string) ([]cvemodels.CveDetail, error) {

diff --git a/detector/detector.go b/detector/detector.go
@@ -96,7 +96,7 @@ func Detect(rs []models.ScanResult, dir string) ([]models.ScanResult, error) {
 			return nil, xerrors.Errorf("Failed to fill with gost: %w", err)
 		}
 
-		if err := FillCvesWithNvdJvn(&r, config.Conf.CveDict, config.Conf.LogOpts); err != nil {
+		if err := FillCvesWithNvdJvnFortinet(&r, config.Conf.CveDict, config.Conf.LogOpts); err != nil {
 			return nil, xerrors.Errorf("Failed to fill with CVE: %w", err)
 		}
 
@@ -327,8 +327,8 @@ func DetectWordPressCves(r *models.ScanResult, wpCnf config.WpScanConf) error {
 	return nil
 }
 
-// FillCvesWithNvdJvn fills CVE detail with NVD, JVN
-func FillCvesWithNvdJvn(r *models.ScanResult, cnf config.GoCveDictConf, logOpts logging.LogOpts) (err error) {
+// FillCvesWithNvdJvnFortinet fills CVE detail with NVD, JVN, Fortinet
+func FillCvesWithNvdJvnFortinet(r *models.ScanResult, cnf config.GoCveDictConf, logOpts logging.LogOpts) (err error) {
 	cveIDs := []string{}
 	for _, v := range r.ScannedCves {
 		cveIDs = append(cveIDs, v.CveID)
@@ -352,6 +352,7 @@ func FillCvesWithNvdJvn(r *models.ScanResult, cnf config.GoCveDictConf, logOpts
 	for _, d := range ds {
 		nvds, exploits, mitigations := models.ConvertNvdToModel(d.CveID, d.Nvds)
 		jvns := models.ConvertJvnToModel(d.CveID, d.Jvns)
+		fortinets := models.ConvertFortinetToModel(d.CveID, d.Fortinets)
 
 		alerts := fillCertAlerts(&d)
 		for cveID, vinfo := range r.ScannedCves {
@@ -364,7 +365,7 @@ func FillCvesWithNvdJvn(r *models.ScanResult, cnf config.GoCveDictConf, logOpts
 						vinfo.CveContents[con.Type] = []models.CveContent{con}
 					}
 				}
-				for _, con := range jvns {
+				for _, con := range append(jvns, fortinets...) {
 					if !con.Empty() {
 						found := false
 						for _, cveCont := range vinfo.CveContents[con.Type] {
@@ -511,6 +512,13 @@ func DetectCpeURIsCves(r *models.ScanResult, cpes []Cpe, cnf config.GoCveDictCon
 
 		for _, detail := range details {
 			advisories := []models.DistroAdvisory{}
+			if detail.HasFortinet() {
+				for _, fortinet := range detail.Fortinets {
+					advisories = append(advisories, models.DistroAdvisory{
+						AdvisoryID: fortinet.AdvisoryID,
+					})
+				}
+			}
 			if !detail.HasNvd() && detail.HasJvn() {
 				for _, jvn := range detail.Jvns {
 					advisories = append(advisories, models.DistroAdvisory{
@@ -542,9 +550,25 @@ func DetectCpeURIsCves(r *models.ScanResult, cpes []Cpe, cnf config.GoCveDictCon
 }
 
 func getMaxConfidence(detail cvemodels.CveDetail) (max models.Confidence) {
-	if !detail.HasNvd() && detail.HasJvn() {
-		return models.JvnVendorProductMatch
-	} else if detail.HasNvd() {
+	if detail.HasFortinet() {
+		for _, fortinet := range detail.Fortinets {
+			confidence := models.Confidence{}
+			switch fortinet.DetectionMethod {
+			case cvemodels.FortinetExactVersionMatch:
+				confidence = models.FortinetExactVersionMatch
+			case cvemodels.FortinetRoughVersionMatch:
+				confidence = models.FortinetRoughVersionMatch
+			case cvemodels.FortinetVendorProductMatch:
+				confidence = models.FortinetVendorProductMatch
+			}
+			if max.Score < confidence.Score {
+				max = confidence
+			}
+		}
+		return max
+	}
+
+	if detail.HasNvd() {
 		for _, nvd := range detail.Nvds {
 			confidence := models.Confidence{}
 			switch nvd.DetectionMethod {
@@ -559,7 +583,13 @@ func getMaxConfidence(detail cvemodels.CveDetail) (max models.Confidence) {
 				max = confidence
 			}
 		}
+		return max
 	}
+
+	if detail.HasJvn() {
+		return models.JvnVendorProductMatch
+	}
+
 	return max
 }
 

diff --git a/detector/detector_test.go b/detector/detector_test.go
@@ -69,6 +69,19 @@ func Test_getMaxConfidence(t *testing.T) {
 			},
 			wantMax: models.NvdVendorProductMatch,
 		},
+		{
+			name: "FortinetExactVersionMatch",
+			args: args{
+				detail: cvemodels.CveDetail{
+					Nvds: []cvemodels.Nvd{
+						{DetectionMethod: cvemodels.NvdExactVersionMatch},
+					},
+					Jvns:      []cvemodels.Jvn{{DetectionMethod: cvemodels.JvnVendorProductMatch}},
+					Fortinets: []cvemodels.Fortinet{{DetectionMethod: cvemodels.FortinetExactVersionMatch}},
+				},
+			},
+			wantMax: models.FortinetExactVersionMatch,
+		},
 		{
 			name: "empty",
 			args: args{

diff --git a/go.mod b/go.mod
@@ -20,15 +20,15 @@ require (
 	github.com/emersion/go-smtp v0.16.0
 	github.com/google/go-cmp v0.5.9
 	github.com/google/subcommands v1.2.0
-	github.com/google/uuid v1.3.0
+	github.com/google/uuid v1.3.1
 	github.com/gosnmp/gosnmp v1.35.0
 	github.com/gosuri/uitable v0.0.4
 	github.com/hashicorp/go-uuid v1.0.3
 	github.com/hashicorp/go-version v1.6.0
 	github.com/jesseduffield/gocui v0.3.0
 	github.com/k0kubun/pp v3.0.1+incompatible
 	github.com/knqyf263/go-apk-version v0.0.0-20200609155635-041fdbb8563f
-	github.com/knqyf263/go-cpe v0.0.0-20201213041631-54f6ab28673f
+	github.com/knqyf263/go-cpe v0.0.0-20230627041855-cb0794d06872
 	github.com/knqyf263/go-deb-version v0.0.0-20190517075300-09fca494f03d
 	github.com/knqyf263/go-rpm-version v0.0.0-20220614171824-631e686d1075
 	github.com/kotakanbe/go-pingscanner v0.1.0
@@ -44,7 +44,7 @@ require (
 	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/cobra v1.7.0
 	github.com/vulsio/go-cti v0.0.3
-	github.com/vulsio/go-cve-dictionary v0.8.4
+	github.com/vulsio/go-cve-dictionary v0.9.1-0.20230925070138-66e5573a03bd
 	github.com/vulsio/go-exploitdb v0.4.5
 	github.com/vulsio/go-kev v0.1.2
 	github.com/vulsio/go-msfdb v0.2.2
@@ -83,7 +83,7 @@ require (
 	github.com/briandowns/spinner v1.23.0 // indirect
 	github.com/caarlos0/env/v6 v6.10.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-	github.com/cheggaaa/pb/v3 v3.1.2 // indirect
+	github.com/cheggaaa/pb/v3 v3.1.4 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/dnaeon/go-vcr v1.2.0 // indirect
@@ -95,8 +95,8 @@ require (
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/fatih/color v1.15.0 // indirect
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
-	github.com/glebarez/go-sqlite v1.21.1 // indirect
-	github.com/glebarez/sqlite v1.8.1-0.20230417114740-1accfe103bf2 // indirect
+	github.com/glebarez/go-sqlite v1.21.2 // indirect
+	github.com/glebarez/sqlite v1.9.0 // indirect
 	github.com/go-redis/redis/v8 v8.11.5 // indirect
 	github.com/go-sql-driver/mysql v1.7.1 // indirect
 	github.com/go-stack/stack v1.8.1 // indirect
@@ -122,7 +122,7 @@ require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
-	github.com/jackc/pgx/v5 v5.3.1 // indirect
+	github.com/jackc/pgx/v5 v5.4.3 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
@@ -134,31 +134,30 @@ require (
 	github.com/masahiro331/go-mvn-version v0.0.0-20210429150710-d3157d602a08 // indirect
 	github.com/masahiro331/go-xfs-filesystem v0.0.0-20221127135739-051c25f1becd // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
-	github.com/mattn/go-isatty v0.0.18 // indirect
-	github.com/mattn/go-runewidth v0.0.14 // indirect
+	github.com/mattn/go-isatty v0.0.19 // indirect
+	github.com/mattn/go-runewidth v0.0.15 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/nsf/termbox-go v1.1.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.0-rc2 // indirect
-	github.com/pelletier/go-toml/v2 v2.0.7 // indirect
+	github.com/pelletier/go-toml/v2 v2.1.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.4 // indirect
-	github.com/rogpeppe/go-internal v1.8.1 // indirect
 	github.com/samber/lo v1.33.0 // indirect
 	github.com/sergi/go-diff v1.3.1 // indirect
 	github.com/smartystreets/assertions v1.13.0 // indirect
 	github.com/spdx/tools-golang v0.3.0 // indirect
-	github.com/spf13/afero v1.9.5 // indirect
-	github.com/spf13/cast v1.5.0 // indirect
+	github.com/spf13/afero v1.10.0 // indirect
+	github.com/spf13/cast v1.5.1 // indirect
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/spf13/viper v1.15.0 // indirect
+	github.com/spf13/viper v1.16.0 // indirect
 	github.com/stretchr/objx v0.5.0 // indirect
-	github.com/stretchr/testify v1.8.2 // indirect
-	github.com/subosito/gotenv v1.4.2 // indirect
+	github.com/stretchr/testify v1.8.4 // indirect
+	github.com/subosito/gotenv v1.6.0 // indirect
 	github.com/ulikunitz/xz v0.5.11 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	go.opencensus.io v0.24.0 // indirect
@@ -181,13 +180,13 @@ require (
 	google.golang.org/protobuf v1.31.0 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	gorm.io/driver/mysql v1.5.0 // indirect
-	gorm.io/driver/postgres v1.5.0 // indirect
-	gorm.io/gorm v1.25.0 // indirect
+	gorm.io/driver/mysql v1.5.1 // indirect
+	gorm.io/driver/postgres v1.5.2 // indirect
+	gorm.io/gorm v1.25.4 // indirect
 	k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed // indirect
-	modernc.org/libc v1.22.6 // indirect
-	modernc.org/mathutil v1.5.0 // indirect
-	modernc.org/memory v1.5.0 // indirect
-	modernc.org/sqlite v1.22.1 // indirect
+	modernc.org/libc v1.24.1 // indirect
+	modernc.org/mathutil v1.6.0 // indirect
+	modernc.org/memory v1.7.1 // indirect
+	modernc.org/sqlite v1.25.0 // indirect
 	moul.io/http2curl v1.0.0 // indirect
 )