Skip to content

Commit 079bc89

Browse files
manuel-sommermanuel-sommer
authored
🐛 fix AWSSecurityHub EPSS Score #10956 (#10959)
* 🐛 fix AWSSecurityHub EPSS Score #10956 * fix * fix
1 parent 5992edc commit 079bc89

3 files changed

Lines changed: 125 additions & 1 deletion

File tree

‎dojo/tools/awssecurityhub/inspector.py‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,10 @@ def get_item(self, finding: dict, test):
1212
impact = []
1313
references = []
1414
unsaved_vulnerability_ids = []
15-
epss_score = None
15+
if finding.get("EpssScore") is not None:
16+
epss_score = finding.get("EpssScore")
17+
else:
18+
epss_score = None
1619
description = f"This is an Inspector Finding\n{finding.get('Description', '')}" + "\n"
1720
description += f"**AWS Finding ARN:** {finding_id}\n"
1821
description += f"**AwsAccountId:** {finding.get('AwsAccountId', '')}\n"

‎unittests/scans/awssecurityhub/issue_10956.json‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
{
2+
"findings": [
3+
{
4+
"EpssScore": "0.00239",
5+
"SchemaVersion": "2018-10-08",
6+
"Id": "arn:aws:inspector2:us-east-1:1234567:finding/12344bc",
7+
"ProductArn": "arn:aws:securityhub:us-east-1::product/aws/inspector",
8+
"ProductName": "Inspector",
9+
"CompanyName": "Amazon",
10+
"Region": "us-east-1",
11+
"GeneratorId": "AWSInspector",
12+
"AwsAccountId": "1234567",
13+
"Types": [
14+
"Software and Configuration Checks/Vulnerabilities/CVE"
15+
],
16+
"FirstObservedAt": "2024-07-30T12:17:32.646Z",
17+
"LastObservedAt": "2024-09-18T05:16:44.106Z",
18+
"CreatedAt": "2024-07-30T12:17:32.646Z",
19+
"UpdatedAt": "2024-09-18T05:16:44.106Z",
20+
"Severity": {
21+
"Label": "MEDIUM",
22+
"Normalized": 50
23+
},
24+
"Title": "CVE-2024-123 - fdd",
25+
"Description": "A vulnerability was found in sdd.",
26+
"Remediation": {
27+
"Recommendation": {
28+
"Text": "None Provided"
29+
}
30+
},
31+
"ProductFields": {
32+
"aws/inspector/FindingStatus": "ACTIVE",
33+
"aws/inspector/inspectorScore": "5.1",
34+
"aws/inspector/resources/1/resourceDetails/awsEc2InstanceDetails/platform": "AMAZON_LINUX_2023",
35+
"aws/inspector/ProductVersion": "1",
36+
"aws/inspector/instanceId": "i-1234xxyy",
37+
"aws/securityhub/FindingId": "arn:aws:inspector2:us-east-1:1234567:finding/addfss",
38+
"aws/securityhub/ProductName": "Inspector",
39+
"aws/securityhub/CompanyName": "Amazon"
40+
},
41+
"Resources": [
42+
{
43+
"Type": "AwsEc2Instance",
44+
"Id": "i-1234xxyy",
45+
"Partition": "aws",
46+
"Region": "us-east-1",
47+
"Tags": {
48+
"Name": "Name:xx-123-yy"
49+
},
50+
"Details": {
51+
"AwsEc2Instance": {
52+
"Type": "tt",
53+
"ImageId": "ami-1234",
54+
"IpV4Addresses": [
55+
"0.0.0.0"
56+
],
57+
"IamInstanceProfileArn": "arn:aws:iam::1234567:instance-profile/something",
58+
"VpcId": "vpc-1234",
59+
"SubnetId": "subnet-xxxxxxx",
60+
"LaunchedAt": "2024-09-18T05:16:44.106Z"
61+
}
62+
}
63+
}
64+
],
65+
"WorkflowState": "NEW",
66+
"Workflow": {
67+
"Status": "NEW"
68+
},
69+
"RecordState": "ACTIVE",
70+
"Vulnerabilities": [
71+
{
72+
"Id": "CVE-2024-1234",
73+
"VulnerablePackages": [
74+
{
75+
"Name": "aa",
76+
"Version": "1.2.0",
77+
"Architecture": "X86_64]",
78+
"PackageManager": "OS",
79+
"FixedInVersion": "abc[2.0]"
80+
}
81+
],
82+
"Cvss": [
83+
{
84+
"Version": "3.1",
85+
"BaseScore": "7.5",
86+
"BaseVector": "CVSS:9.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
87+
"Source": "NVD"
88+
}
89+
],
90+
"Vendor": {
91+
"Name": "AMAZON_CVE",
92+
"Url": "https://alas.aws.amazon.com/cve/json/v1/CVE-2024-1234.json",
93+
"VendorSeverity": "Medium",
94+
"VendorCreatedAt": "2024-01-16T00:00:00Z",
95+
"VendorUpdatedAt": "2024-09-18T05:16:44.106Z"
96+
},
97+
"ReferenceUrls": [
98+
"https://alas.aws.amazon.com"
99+
],
100+
"FixAvailable": "YES"
101+
}
102+
],
103+
"FindingProviderFields": {
104+
"Severity": {
105+
"Label": "MEDIUM"
106+
},
107+
"Types": [
108+
"Software and Configuration Checks/Vulnerabilities/CVE"
109+
]
110+
}
111+
}
112+
]
113+
}

‎unittests/tools/test_awssecurityhub_parser.py‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,3 +126,11 @@ def test_guardduty(self):
126126
endpoint = findings[0].unsaved_endpoints[0]
127127
self.assertEqual("AwsEc2Instance arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890", endpoint.host)
128128
self.assertEqual("This is a GuardDuty Finding\nAPIs commonly used in Discovery tactics were invoked by user AssumedRole : 123123123, under anomalous circumstances. Such activity is not typically seen from this user.\n**AWS Finding ARN:** arn:aws:guardduty:us-east-1:123456789012:detector/123456789/finding/2123123123123\n**SourceURL:** [https://us-east-1.console.aws.amazon.com/guardduty/home?region=us-east-1#/findings?macros=current&fId=2123123123123](https://us-east-1.console.aws.amazon.com/guardduty/home?region=us-east-1#/findings?macros=current&fId=2123123123123)\n**AwsAccountId:** 123456789012\n**Region:** us-east-1\n**Generator ID:** arn:aws:guardduty:us-east-1:123456789012:detector/123456789\n", finding.description)
129+
130+
def test_issue_10956(self):
131+
with open(get_unit_tests_path() + sample_path("issue_10956.json"), encoding="utf-8") as test_file:
132+
parser = AwsSecurityHubParser()
133+
findings = parser.get_findings(test_file, Test())
134+
self.assertEqual(1, len(findings))
135+
finding = findings[0]
136+
self.assertEqual("0.00239", finding.epss_score)

0 commit comments

Comments
 (0)