Feature: Adding custom feeds to the database

[Nadir-CS]

Request Description

Hello,
I'm wondering how to add custom entries to the VDB database so that depscan will find these custom vulnerable dependencies when scanning.
I see that VDB5 uses jsondb.
Please tell me how to do this correctly?

Additional Information

No response

[prabhu]

This requires a bit of python programming atm. Please take a look at some existing sources such as GHSA.

https://github.com/AppThreat/vulnerability-db/blob/master/vdb/lib/gha.py

[Nadir-CS]

This requires a bit of python programming atm. Please take a look at some existing sources such as GHSA.

https://github.com/AppThreat/vulnerability-db/blob/master/vdb/lib/gha.py

Thank you very much for your reply!
Yes, I understand that the code provided shows how the information from the GitHub Security Advisory is entered into the required json structure.
I just wanted to clarify if we have a file (custom_rules.json) with custom rules that match the structure of data.vdb5, for example:

{
  "id": "CUSTOM-FEEDS-NUMBER-1",
  "problem_type": "CWE-914",
  "score": 2.0,
  "severity": {
    "type": "Severity",
    "value": "LOW"
  },
  "description": "My custom description",
  "related_urls": [
    "https://www.npmjs.com/package/ddos"
  ],
  "details": {
    "type": "VulnerabilityDetail",
    "cpe_uri": "cpe:2.3:a:npm:ddos:*:*:*:*:*:*:*:*",
    "package": "ddos",
    "mii": "0.2.1",
    "mai": "*",
    "mie": null,
    "mae": null,
    "severity": {
      "type": "Severity",
      "value": "UNSPECIFIED"
    },
    "description": null,
    "fixed_location": "cpe:2.3:a:npm:ddos::*:*:*:*:*:*:*",
    "package_type": "npm",
    "is_obsolete": null,
    "source_update_time": {
      "type": "datetime",
      "value": "2022-11-23T15:39:50+00:00"
    }
  },
  "cvss_v3": {
    "type": "CvssV3",
    "base_score": 2.0,
    "exploitability_score": 2.0,
    "impact_score": 2.0,
    "attack_vector": "NETWORK",
    "attack_complexity": "HIGH",
    "privileges_required": "NONE",
    "user_interaction": "REQUIRED",
    "scope": "UNCHANGED",
    "confidentiality_impact": "LOW",
    "integrity_impact": "LOW",
    "availability_impact": "LOW",
    "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
  }
}

How to enter it correctly into data.vdb5 and data.index.vdb5 so that depscan can find these feeds during further scanning?

[prabhu]

We can use VDB6 since it uses SQLite. Maybe standardize on the CVE schema 5.0/5.1 spec too. There is already cve.py which can be reused, so a matter of creating a new source and pointing it to a custom directory.

@cerrussell any thoughts?

[Pamplemousse]

Would it be possible to pass such a list in memory rather than having to write to a DB ahead of starting depscan?

I envision something like depscan ... --extra-vuln-from my-db.json, where my-db.json would contain enough information for the analysis to be able to correlate the added vulnerabilities to the packages in a BOM (e.g., a purl).

[prabhu]

Is this purely an enterprise use case, or is there a scenario where an open-source user might legitimately benefit from tracking private or undisclosed vulnerabilities? I am fundamentally against keeping vulnerabilities hidden.

[Pamplemousse]

or is there a scenario where an open-source user might legitimately benefit from tracking private or undisclosed vulnerabilities?

When the vulnerability has been disclosed but didn't receive a proper identifier yet, or didn't have time to reach the vulnerability database.
Recent example with the sha1-hulud incident. Where the list of affected packages was disclosed on websites, and updated live (as more packages were being compromised), while the advisories database lagged a little bit behind.

I am fundamentally against keeping vulnerabilities hidden

And I very much agree!

[prabhu]

I have added custom data support in VDB in PR 237. This is scheduled for VDB 6.6.x (and depscan 6.1.x).

AppThreat/vulnerability-db#237

Could you try this feature with VDB master directly and let me know how it looks? The readme has detailed instructions.