Skip to content

Commit 7f3c168

Browse files
ziadhanyziadhany
committed
Migrate ( metasploit, exploit-db, kev ) to aboutcode pipeline.
Set data_source as the header for the exploit table. Squash the migration files into a single file. Add test for exploit-db , metasploit Add a missing migration file Rename resources_and_notes to notes Fix Api test Refactor metasploit , exploitdb , kev improver Rename Kev tab to exploit tab Add support for exploitdb , metasploit, kev Signed-off-by: ziadhany <ziadhany2016@gmail.com>
1 parent ed17dbd commit 7f3c168

14 files changed

Lines changed: 744 additions & 156 deletions

File tree

‎vulnerabilities/api.py‎

Lines changed: 19 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
from rest_framework.throttling import UserRateThrottle
2828

2929
from vulnerabilities.models import Alias
30-
from vulnerabilities.models import Kev
30+
from vulnerabilities.models import Exploit
3131
from vulnerabilities.models import Package
3232
from vulnerabilities.models import Vulnerability
3333
from vulnerabilities.models import VulnerabilityReference
@@ -175,10 +175,23 @@ def to_representation(self, instance):
175175
return representation
176176

177177

178-
class KEVSerializer(serializers.ModelSerializer):
178+
class ExploitSerializer(serializers.ModelSerializer):
179179
class Meta:
180-
model = Kev
181-
fields = ["date_added", "description", "required_action", "due_date", "resources_and_notes"]
180+
model = Exploit
181+
fields = [
182+
"date_added",
183+
"description",
184+
"required_action",
185+
"due_date",
186+
"notes",
187+
"known_ransomware_campaign_use",
188+
"source_date_published",
189+
"exploit_type",
190+
"platform",
191+
"source_date_updated",
192+
"data_source",
193+
"source_url",
194+
]
182195

183196

184197
class VulnerabilitySerializer(BaseResourceSerializer):
@@ -189,7 +202,7 @@ class VulnerabilitySerializer(BaseResourceSerializer):
189202

190203
references = VulnerabilityReferenceSerializer(many=True, source="vulnerabilityreference_set")
191204
aliases = AliasSerializer(many=True, source="alias")
192-
kev = KEVSerializer(read_only=True)
205+
exploits = ExploitSerializer(many=True, read_only=True)
193206
weaknesses = WeaknessSerializer(many=True)
194207
severity_range_score = serializers.SerializerMethodField()
195208

@@ -199,10 +212,6 @@ def to_representation(self, instance):
199212
weaknesses = data.get("weaknesses", [])
200213
data["weaknesses"] = [weakness for weakness in weaknesses if weakness is not None]
201214

202-
kev = data.get("kev", None)
203-
if not kev:
204-
data.pop("kev")
205-
206215
return data
207216

208217
def get_severity_range_score(self, instance):
@@ -240,7 +249,7 @@ class Meta:
240249
"affected_packages",
241250
"references",
242251
"weaknesses",
243-
"kev",
252+
"exploits",
244253
"severity_range_score",
245254
]
246255

‎vulnerabilities/improvers/vulnerability_kev.py‎

Lines changed: 0 additions & 66 deletions
This file was deleted.

‎vulnerabilities/migrations/0063_exploit_delete_kev.py‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
# Generated by Django 4.1.13 on 2024-09-10 18:40
2+
3+
from django.db import migrations, models
4+
import django.db.models.deletion
5+
6+
7+
class Migration(migrations.Migration):
8+
9+
dependencies = [
10+
("vulnerabilities", "0062_package_is_ghost"),
11+
]
12+
13+
operations = [
14+
migrations.CreateModel(
15+
name="Exploit",
16+
fields=[
17+
(
18+
"id",
19+
models.AutoField(
20+
auto_created=True, primary_key=True, serialize=False, verbose_name="ID"
21+
),
22+
),
23+
(
24+
"date_added",
25+
models.DateField(
26+
blank=True,
27+
help_text="The date the vulnerability was added to an exploit catalog.",
28+
null=True,
29+
),
30+
),
31+
(
32+
"description",
33+
models.TextField(
34+
blank=True,
35+
help_text="Description of the vulnerability in an exploit catalog, often a refinement of the original CVE description",
36+
null=True,
37+
),
38+
),
39+
(
40+
"required_action",
41+
models.TextField(
42+
blank=True,
43+
help_text="The required action to address the vulnerability, typically to apply vendor updates or apply vendor mitigations or to discontinue use.",
44+
null=True,
45+
),
46+
),
47+
(
48+
"due_date",
49+
models.DateField(
50+
blank=True,
51+
help_text="The date the required action is due, which applies to all USA federal civilian executive branch (FCEB) agencies, but all organizations are strongly encouraged to execute the required action",
52+
null=True,
53+
),
54+
),
55+
(
56+
"notes",
57+
models.TextField(
58+
blank=True,
59+
help_text="Additional notes and resources about the vulnerability, often a URL to vendor instructions.",
60+
null=True,
61+
),
62+
),
63+
(
64+
"known_ransomware_campaign_use",
65+
models.BooleanField(
66+
default=False,
67+
help_text="Known' if this vulnerability is known to have been leveraged as part of a ransomware campaign; \n or 'Unknown' if there is no confirmation that the vulnerability has been utilized for ransomware.",
68+
),
69+
),
70+
(
71+
"source_date_published",
72+
models.DateField(
73+
blank=True,
74+
help_text="The date that the exploit was published or disclosed.",
75+
null=True,
76+
),
77+
),
78+
(
79+
"exploit_type",
80+
models.TextField(
81+
blank=True,
82+
help_text="The type of the exploit as provided by the original upstream data source.",
83+
null=True,
84+
),
85+
),
86+
(
87+
"platform",
88+
models.TextField(
89+
blank=True,
90+
help_text="The platform associated with the exploit as provided by the original upstream data source.",
91+
null=True,
92+
),
93+
),
94+
(
95+
"source_date_updated",
96+
models.DateField(
97+
blank=True,
98+
help_text="The date the exploit was updated in the original upstream data source.",
99+
null=True,
100+
),
101+
),
102+
(
103+
"data_source",
104+
models.TextField(
105+
blank=True,
106+
help_text="The source of the exploit information, such as CISA KEV, exploitdb, metaspoit, or others.",
107+
null=True,
108+
),
109+
),
110+
(
111+
"source_url",
112+
models.URLField(
113+
blank=True,
114+
help_text="The URL to the exploit as provided in the original upstream data source.",
115+
null=True,
116+
),
117+
),
118+
(
119+
"vulnerability",
120+
models.ForeignKey(
121+
on_delete=django.db.models.deletion.CASCADE,
122+
related_name="exploits",
123+
to="vulnerabilities.vulnerability",
124+
),
125+
),
126+
],
127+
),
128+
migrations.DeleteModel(
129+
name="Kev",
130+
),
131+
]

‎vulnerabilities/models.py‎

Lines changed: 57 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1389,49 +1389,90 @@ def log_fixing(cls, package, importer, source_url, related_vulnerability):
13891389
)
13901390

13911391

1392-
class Kev(models.Model):
1392+
class Exploit(models.Model):
13931393
"""
1394-
Known Exploited Vulnerabilities
1394+
A vulnerability exploit is code used to
1395+
take advantage of a security flaw for unauthorized access or malicious activity.
13951396
"""
13961397

1397-
vulnerability = models.OneToOneField(
1398+
vulnerability = models.ForeignKey(
13981399
Vulnerability,
1400+
related_name="exploits",
13991401
on_delete=models.CASCADE,
1400-
related_name="kev",
14011402
)
14021403

14031404
date_added = models.DateField(
1404-
help_text="The date the vulnerability was added to the Known Exploited Vulnerabilities"
1405-
" (KEV) catalog in the format YYYY-MM-DD.",
14061405
null=True,
14071406
blank=True,
1407+
help_text="The date the vulnerability was added to an exploit catalog.",
14081408
)
14091409

14101410
description = models.TextField(
1411-
help_text="Description of the vulnerability in the Known Exploited Vulnerabilities"
1412-
" (KEV) catalog, usually a refinement of the original CVE description"
1411+
null=True,
1412+
blank=True,
1413+
help_text="Description of the vulnerability in an exploit catalog, often a refinement of the original CVE description",
14131414
)
14141415

14151416
required_action = models.TextField(
1417+
null=True,
1418+
blank=True,
14161419
help_text="The required action to address the vulnerability, typically to "
1417-
"apply vendor updates or apply vendor mitigations or to discontinue use."
1420+
"apply vendor updates or apply vendor mitigations or to discontinue use.",
14181421
)
14191422

14201423
due_date = models.DateField(
1421-
help_text="The date the required action is due in the format YYYY-MM-DD,"
1422-
"which applies to all USA federal civilian executive branch (FCEB) agencies,"
1423-
"but all organizations are strongly encouraged to execute the required action."
1424+
null=True,
1425+
blank=True,
1426+
help_text="The date the required action is due, which applies"
1427+
" to all USA federal civilian executive branch (FCEB) agencies, "
1428+
"but all organizations are strongly encouraged to execute the required action",
14241429
)
14251430

1426-
resources_and_notes = models.TextField(
1431+
notes = models.TextField(
1432+
null=True,
1433+
blank=True,
14271434
help_text="Additional notes and resources about the vulnerability,"
1428-
" often a URL to vendor instructions."
1435+
" often a URL to vendor instructions.",
14291436
)
14301437

14311438
known_ransomware_campaign_use = models.BooleanField(
14321439
default=False,
1433-
help_text="""Known if this vulnerability is known to have been leveraged as part of a ransomware campaign;
1434-
or 'Unknown' if CISA lacks confirmation that the vulnerability has been utilized for ransomware.""",
1440+
help_text="""Known' if this vulnerability is known to have been leveraged as part of a ransomware campaign;
1441+
or 'Unknown' if there is no confirmation that the vulnerability has been utilized for ransomware.""",
1442+
)
1443+
1444+
source_date_published = models.DateField(
1445+
null=True, blank=True, help_text="The date that the exploit was published or disclosed."
1446+
)
1447+
1448+
exploit_type = models.TextField(
1449+
null=True,
1450+
blank=True,
1451+
help_text="The type of the exploit as provided by the original upstream data source.",
1452+
)
1453+
1454+
platform = models.TextField(
1455+
null=True,
1456+
blank=True,
1457+
help_text="The platform associated with the exploit as provided by the original upstream data source.",
1458+
)
1459+
1460+
source_date_updated = models.DateField(
1461+
null=True,
1462+
blank=True,
1463+
help_text="The date the exploit was updated in the original upstream data source.",
1464+
)
1465+
1466+
data_source = models.TextField(
1467+
null=True,
1468+
blank=True,
1469+
help_text="The source of the exploit information, such as CISA KEV, exploitdb, metaspoit, or others.",
1470+
)
1471+
1472+
source_url = models.URLField(
1473+
null=True,
1474+
blank=True,
1475+
help_text="The URL to the exploit as provided in the original upstream data source.",
14351476
)
14361477

14371478
@property

0 commit comments

Comments
 (0)