Skip to content

Commit df8cf8c

Browse files
mkmuralimkmurali
committed
first commit
0 parents  commit df8cf8c

File tree

9 files changed

+691
-0
lines changed

9 files changed

+691
-0
lines changed

‎.github/dependabot.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# To get started with Dependabot version updates, you'll need to specify which
2+
# package ecosystems to update and where the package manifests are located.
3+
# Please see the documentation for all configuration options:
4+
# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
5+
6+
version: 2
7+
updates:
8+
- package-ecosystem: "npm" # See documentation for possible values
9+
directory: "/" # Location of package manifests
10+
schedule:
11+
interval: "weekly"

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
#
7+
# ******** NOTE ********
8+
# We have attempted to detect the languages in your repository. Please check
9+
# the `language` matrix defined below to confirm you have the correct set of
10+
# supported CodeQL languages.
11+
#
12+
name: "CodeQL"
13+
14+
on:
15+
push:
16+
branches: [master]
17+
pull_request:
18+
# The branches below must be a subset of the branches above
19+
branches: [master]
20+
schedule:
21+
- cron: "41 0 * * 4"
22+
23+
jobs:
24+
analyze:
25+
name: Analyze
26+
runs-on: ubuntu-latest
27+
permissions:
28+
actions: read
29+
contents: read
30+
security-events: write
31+
32+
strategy:
33+
fail-fast: false
34+
matrix:
35+
language: ["javascript"]
36+
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
37+
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
38+
39+
steps:
40+
- name: Checkout repository
41+
uses: actions/checkout@v3
42+
43+
# Initializes the CodeQL tools for scanning.
44+
- name: Initialize CodeQL
45+
uses: github/codeql-action/init@v2
46+
with:
47+
languages: ${{ matrix.language }}
48+
# If you wish to specify custom queries, you can do so here or in a config file.
49+
# By default, queries listed here will override any specified in a config file.
50+
# Prefix the list here with "+" to use these queries and those in the config file.
51+
52+
# Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
53+
# queries: security-extended,security-and-quality
54+
55+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
56+
# If this step fails, then you should remove it and run the build manually (see below)
57+
- name: Autobuild
58+
uses: github/codeql-action/autobuild@v2
59+
60+
# ℹ️ Command-line programs to run using the OS shell.
61+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
62+
63+
# If the Autobuild fails above, remove it and uncomment the following three lines.
64+
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
65+
66+
# - run: |
67+
# echo "Run, Build Application using script"
68+
# ./location_of_script_within_repo/buildscript.sh
69+
70+
- name: Perform CodeQL Analysis
71+
uses: github/codeql-action/analyze@v2

‎.github/workflows/npm-publish.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
2+
# For more information see: https://help.github.com/actions/language-and-framework-guides/publishing-nodejs-packages
3+
4+
name: Node.js Package
5+
6+
on:
7+
push:
8+
tags-ignore:
9+
- "**"
10+
branches:
11+
- main
12+
jobs:
13+
build:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- uses: actions/checkout@v2
17+
- uses: actions/setup-node@v1
18+
with:
19+
node-version: 18
20+
- run: npm ci
21+
# - run: npm test
22+
23+
publish-npm:
24+
needs: build
25+
runs-on: ubuntu-latest
26+
steps:
27+
- uses: actions/checkout@v2
28+
- uses: actions/setup-node@v1
29+
with:
30+
node-version: 18
31+
registry-url: https://registry.npmjs.org/
32+
- run: npm ci
33+
- run: npm publish
34+
env:
35+
NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
node_modules

‎LICENSE‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
MIT License
2+
3+
Copyright (c) 2023 Softrams LLC
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
6+
7+
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
8+
9+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

‎README.md‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
# CVE Risk Scores
2+
3+
Check CVSS v3.1 and EPSS scores for a given CVE ID by querying the NIST NVD API and FIRST EPSS database.
4+
Also check if the CVE is listed in the CISA Known Exploited Vulnerability (KEV) catalog.
5+
6+
## About CVSS
7+
8+
CVSS stands for Common Vulnerability Scoring System. It is a standardized system for rating the severity of security vulnerabilities in software. The CVSS score is a number between 0 and 10, with a higher score indicating a more severe vulnerability. The CVSS score is calculated using a variety of factors, including the severity of the vulnerability, the availability of exploit code, and the number of known attacks.
9+
10+
See CVSS at [https://www.first.org/cvss](https://www.first.org/cvss).
11+
12+
## About EPSS
13+
14+
EPSS stands for Exploit Prediction Scoring System. It is a machine learning-based model that predicts the likelihood of a software vulnerability being exploited in the wild. The EPSS score is a number between 0 and 1, with a higher score indicating a higher likelihood of exploitation. The EPSS score is calculated using a variety of factors, including the severity of the vulnerability, the availability of exploit code, and the number of known attacks.
15+
16+
See EPSS at [https://www.first.org/epss](https://www.first.org/epss).
17+
18+
## About CISA Known Exploited Vulnerability (KEV) catalog
19+
20+
> For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild: the Known Exploited Vulnerability (KEV) catalog. CISA strongly recommends all organizations review and monitor the KEV catalog and prioritize remediation of the listed vulnerabilities to reduce the likelihood of compromise by known threat actors. All federal civilian executive branch (FCEB) agencies are required to remediate vulnerabilities in the KEV catalog within prescribed timeframes.
21+
22+
See CISA KEV Catalog at [https://www.cisa.gov/known-exploited-vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities).
23+
24+
## Usage
25+
26+
### Usage via npx
27+
28+
```bash
29+
## Run the tool in the project directory
30+
npx cve-risk-scores@latest
31+
```
32+
33+
### Usage via global install option
34+
35+
```bash
36+
## Install the tool globally
37+
npm install -g cve-risk-scores@latest
38+
39+
## Run the tool in the project directory
40+
cve-risk-scores CVE-YYYY-XXXXX
41+
```
42+
43+
### Options
44+
45+
```bash
46+
Usage: cve-risk-scores [-v|--verbose] [-r|--refresh] [-f|--fail-on-past-duedate] [-t|--threshold] [-s|--score]
47+
48+
Options:
49+
--version Show version number [boolean]
50+
-v, --verbose Verbose output
51+
-r, --refresh Refresh EPSS scores
52+
-f, --fail-on-past-duedate Fail on past CISA KVE due date
53+
-t, --threshold EPSS score threshold to fail the audit
54+
[number] [default: 0]
55+
-s, --score CVSS score threshold to fail the audit
56+
[number] [default: 0]
57+
--help Show help [boolean]
58+
59+
```
60+
61+
### Exit Codes
62+
63+
For use in CI pipelines and automation tools, the tool will exit with the following exit codes:
64+
65+
- 0: Ran successfully and no vulnerabilities found
66+
- 1: Failed to run due to errors or other configuration issues
67+
- 2: Ran successfully and vulnerabilities found that
68+
- exceeded the EPSS Score threshold (default: 0.0, means all vulnerabilities are reported) or
69+
- exceeded the CVSS Score threshold (default: 0.0, means all vulnerabilities are reported) or
70+
- are past the CISA KEV due date (default: false, means all vulnerabilities are reported)
71+
72+
You may use one or more of the following options to fail the audit:
73+
74+
- `--fail-on-past-duedate` option to fail the audit if any of the vulnerabilities are past the CISA KEV due date or
75+
- set the `--threshold` option to a value of your choice greater than 0.0 to fail the audit if EPSS Score exceeds threshold or
76+
- set the `--score` option to value of your choice greater than 0.0 to fail the audit if CVSS Score is greater than the threshold.
77+
78+
Audit will fail if any of these conditions are met.
79+
80+
### Example output
81+
82+
```bash
83+
# Run with default options
84+
cve-risk-scores CVE-2023-20273
85+
86+
Auditing CVE-2023-20273 at 10/25/2023, 5:55:24 PM
87+
88+
89+
EPSS score is : 0.01182 (0.83503%)
90+
91+
CISA KEV Date Added: 2023-10-23, Due Date: 2023-10-27
92+
93+
CVSS v3.1 Base Score: 7.2 (HIGH)
94+
95+
```
96+
97+
### Configuration Options
98+
99+
On first run, the tool will create a folder named .epss in the ${HOME} or "/tmp" folder.
100+
This folder will contain the raw EPSS Data file and uncompressed CSV file.
101+
If you would like to choose a different folder, you may set the `EPSS_DATA_FOLDER` environment variable to the desired folder.
102+
103+
## How to contribute
104+
105+
If you would like to contribute to this project, feel free to fork and create PR if you can.
106+
Otherwise, create an issue with your thoughts and ideas.
107+
108+
## References
109+
110+
- [EPSS](https://www.first.org/epss/data_stats)
111+
- [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities)
112+
- [CVSS](https://www.first.org/cvss)

0 commit comments

Comments
 (0)