feat!(models): add vulncheck kev

[MaineK00n]

If this Pull Request is work in progress, Add a prefix of “[WIP]” in the title.

What did you implement:

add KEV field
Then move the CISA KEV information from the alert to VulnInfo.KEV.

Type of change

• Breaking change (fix or feature that would cause existing functionality to not work as expected)

How Has This Been Tested?

$ cat config.toml
[cveDict]
type = "sqlite3"
sqlite3Path = "/usr/share/vuls-data/cve.sqlite3"

[ovalDict]
type = "sqlite3"

[gost]
type = "sqlite3"

[exploit]
type = "sqlite3"

[metasploit]
type = "sqlite3"

[kevuln]
type = "sqlite3"
sqlite3Path = "/usr/share/vuls-data/go-kev.sqlite3"

[cti]
type = "sqlite3"

[servers]

[servers.pseudo]
type = "pseudo"
cpeNames = [
"cpe:2.3:o:paloaltonetworks:pan-os:10.2.0:-:*:*:*:*:*:*",
"cpe:2.3:a:kingsoft:wps_office:v12.2.0.13489:*:*:*:*:*:*:*"
]

$ vuls scan

$ vuls report --refresh-cve
...
pseudo (pseudo)
===============
Total: 4 (Critical:3 High:0 Medium:1 Low:0 ?:0)
0/0 Fixed, 1 poc, 0 exploits, 2 kevs, uscert: 0, jpcert: 0 alerts
0 installed

+---------------+------+--------+-----+-----------+-----------+---------+------------------------------------------+
|    CVE-ID     | CVSS | ATTACK | POC |    KEV    |   ALERT   |  FIXED  |                 PACKAGES                 |
+---------------+------+--------+-----+-----------+-----------+---------+------------------------------------------+
| CVE-2024-3400 | 10.0 |  AV:N  | POC | cisa      |           |         | cpe:/o:paloaltonetworks:pan-os:10.2.0:-  |
+---------------+------+--------+-----+-----------+-----------+---------+------------------------------------------+
| CVE-2024-7262 |  9.3 |  AV:L  |     | vulncheck |           |         | cpe:/a:kingsoft:wps_office:v12.2.0.13489 |
+---------------+------+--------+-----+-----------+-----------+---------+------------------------------------------+
| CVE-2024-7263 |  9.3 |  AV:L  |     |           |           |         | cpe:/a:kingsoft:wps_office:v12.2.0.13489 |
+---------------+------+--------+-----+-----------+-----------+---------+------------------------------------------+
| CVE-2024-5916 |  6.0 |  AV:N  |     |           |           |         | cpe:/o:paloaltonetworks:pan-os:10.2.0:-  |
+---------------+------+--------+-----+-----------+-----------+---------+------------------------------------------+

$ cat results/2024-08-30T00-16-30+0900/pseudo.json | jq -r '.scannedCves."CVE-2024-3400".kevs'
[
  {
    "type": "cisa",
    "vendor_project": "Palo Alto Networks",
    "product": "PAN-OS",
    "vulnerability_name": "Palo Alto Networks PAN-OS Command Injection Vulnerability",
    "short_description": "Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.",
    "required_action": "Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.",
    "known_ransomware_campaign_use": "Unknown",
    "date_added": "2024-04-12T00:00:00Z",
    "due_date": "2024-04-19T00:00:00Z",
    "cisa": {
      "note": "https://security.paloaltonetworks.com/CVE-2024-3400"
    }
  },
  {
    "type": "vulncheck",
    "vendor_project": "Palo Alto Networks",
    "product": "PAN-OS",
    "vulnerability_name": "Palo Alto Networks PAN-OS Command Injection Vulnerability",
    "short_description": "Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.",
    "required_action": "Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.",
    "known_ransomware_campaign_use": "Known",
    "date_added": "2024-04-12T00:00:00Z",
    "due_date": "2024-04-19T00:00:00Z",
    "vulncheck": {
      "xdb": [
        {
          "xdb_id": "23c21d7a298f",
          "xdb_url": "https://vulncheck.com/xdb/23c21d7a298f",
          "date_added": "2024-04-16T17:08:15Z",
          "exploit_type": "initial-access",
          "clone_ssh_url": "git@github.com:CONDITIONBLACK/CVE-2024-3400-POC.git"
        },
        {
          "xdb_id": "111ca00bbc19",
          "xdb_url": "https://vulncheck.com/xdb/111ca00bbc19",
          "date_added": "2024-04-17T04:58:42Z",
          "exploit_type": "initial-access",
          "clone_ssh_url": "git@github.com:index2014/CVE-2024-3400-Checker.git"
        },
        {
          "xdb_id": "926dce09c16f",
          "xdb_url": "https://vulncheck.com/xdb/926dce09c16f",
          "date_added": "2024-04-17T08:27:52Z",
          "exploit_type": "initial-access",
          "clone_ssh_url": "git@github.com:admi-n/CVE-2024-3400-RCE-copy.git"
        },
        ...
        {
          "xdb_id": "5031bc9d21b6",
          "xdb_url": "https://vulncheck.com/xdb/5031bc9d21b6",
          "date_added": "2024-04-16T21:21:41Z",
          "exploit_type": "initial-access",
          "clone_ssh_url": "git@github.com:Chocapikk/CVE-2024-3400.git"
        },
        {
          "xdb_id": "c8807722d985",
          "xdb_url": "https://vulncheck.com/xdb/c8807722d985",
          "date_added": "2024-04-16T16:18:56Z",
          "exploit_type": "initial-access",
          "clone_ssh_url": "git@github.com:W01fh4cker/CVE-2024-3400-RCE-Scan.git"
        },
        {
          "xdb_id": "111e25b96a3d",
          "xdb_url": "https://vulncheck.com/xdb/111e25b96a3d",
          "date_added": "2024-04-16T21:24:15Z",
          "exploit_type": "initial-access",
          "clone_ssh_url": "git@github.com:ihebski/CVE-2024-3400.git"
        }
      ],
      "reported_exploitation": [
        {
          "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
          "date_added": "2024-04-12T00:00:00Z"
        },
        {
          "url": "https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-17&host_type=src&vulnerability=cve-2024-3400",
          "date_added": "2024-04-17T00:00:00Z"
        },
        {
          "url": "https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-04-18&host_type=src&vulnerability=cve-2024-3400",
          "date_added": "2024-04-18T00:00:00Z"
        },
        ...
        {
          "url": "https://ti.qianxin.com/uploads/2024/08/19/2274f632f6a1d8acd2f1801c24887edb.pdf",
          "date_added": "2024-08-19T00:00:00Z"
        },
        {
          "url": "https://www.ptsecurity.com/ru-ru/research/analytics/aktualnye-kiberugrozy-ii-kvartal-2024-goda/",
          "date_added": "2024-08-22T00:00:00Z"
        },
        {
          "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a",
          "date_added": "2024-08-28T00:00:00Z"
        }
      ]
    }
  }
]

Checklist:

You don't have to satisfy all of the following.

• Write tests
• Write documentation
• Check that there aren't other open pull requests for the same issue/feature
• Format your source code by make fmt
• Pass the test by make test
• Provide verification config / commands
• Enable "Allow edits from maintainers" for this PR
• Update the messages below

Is this ready for review?: YES

Reference

• feat!(cmd): add vulncheck vulsio/go-kev#138

[shino]

🎊