|
| 1 | +import logging |
| 2 | +from typing import Iterable |
| 3 | + |
| 4 | +from django.db.models import QuerySet |
| 5 | +from sphinx.util import requests |
| 6 | + |
| 7 | +from vulnerabilities.improver import Improver |
| 8 | +from vulnerabilities.improver import Inference |
| 9 | +from vulnerabilities.models import Advisory |
| 10 | +from vulnerabilities.models import Alias |
| 11 | +from vulnerabilities.models import Kev |
| 12 | + |
| 13 | +logger = logging.getLogger(__name__) |
| 14 | + |
| 15 | + |
| 16 | +class VulnerabilityKevImprover(Improver): |
| 17 | + """ |
| 18 | + Known Exploited Vulnerabilities Improver |
| 19 | + """ |
| 20 | + |
| 21 | + @property |
| 22 | + def interesting_advisories(self) -> QuerySet: |
| 23 | + # TODO Modify KEV improver to iterate over the vulnerabilities alias, not the advisory |
| 24 | + return [Advisory.objects.first()] |
| 25 | + |
| 26 | + def get_inferences(self, advisory_data) -> Iterable[Inference]: |
| 27 | + """ |
| 28 | + Fetch Kev data, iterate over it to find the vulnerability with the specified alias, and create or update |
| 29 | + the Kev instance accordingly. |
| 30 | + """ |
| 31 | + |
| 32 | + kev_url = ( |
| 33 | + "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" |
| 34 | + ) |
| 35 | + response = requests.get(kev_url) |
| 36 | + kev_data = response.json() |
| 37 | + if response.status_code != 200: |
| 38 | + logger.error( |
| 39 | + f"Failed to fetch the CISA Catalog of Known Exploited Vulnerabilities: {kev_url}" |
| 40 | + ) |
| 41 | + return [] |
| 42 | + |
| 43 | + for kev_vul in kev_data.get("vulnerabilities", []): |
| 44 | + alias = Alias.objects.get_or_none(alias=kev_vul["cveID"]) |
| 45 | + if not alias: |
| 46 | + continue |
| 47 | + |
| 48 | + vul = alias.vulnerability |
| 49 | + |
| 50 | + if not vul: |
| 51 | + continue |
| 52 | + |
| 53 | + Kev.objects.update_or_create( |
| 54 | + vulnerability=vul, |
| 55 | + defaults={ |
| 56 | + "description": kev_vul["shortDescription"], |
| 57 | + "date_added": kev_vul["dateAdded"], |
| 58 | + "required_action": kev_vul["requiredAction"], |
| 59 | + "due_date": kev_vul["dueDate"], |
| 60 | + "resources_and_notes": kev_vul["notes"], |
| 61 | + "known_ransomware_campaign_use": True |
| 62 | + if kev_vul["knownRansomwareCampaignUse"] == "Known" |
| 63 | + else False, |
| 64 | + }, |
| 65 | + ) |
| 66 | + return [] |
0 commit comments