|
| 1 | +import hashlib |
| 2 | +from dataclasses import dataclass |
| 3 | + |
| 4 | +from dojo.models import Endpoint, Finding |
| 5 | + |
| 6 | + |
| 7 | +@dataclass |
| 8 | +class OpenVASFindingAuxData: |
| 9 | + |
| 10 | + """Dataclass to contain all information added later to a finding""" |
| 11 | + |
| 12 | + references: list[str] |
| 13 | + summary: str = "" |
| 14 | + qod: str = "" |
| 15 | + openvas_result: str = "" |
| 16 | + fallback_cvss_score: float | None = None |
| 17 | + |
| 18 | + |
| 19 | +def setup_finding(test) -> tuple[Finding, OpenVASFindingAuxData]: |
| 20 | + """Base setup and init for findings and auxiliary data""" |
| 21 | + finding = Finding(test=test, dynamic_finding=True, static_finding=False, severity="Info", nb_occurences=1, cwe=None) |
| 22 | + finding.unsaved_vulnerability_ids = [] |
| 23 | + finding.unsaved_endpoints = [Endpoint()] |
| 24 | + |
| 25 | + aux_info = OpenVASFindingAuxData([]) |
| 26 | + |
| 27 | + return finding, aux_info |
| 28 | + |
| 29 | + |
| 30 | +def is_valid_severity(severity: str) -> bool: |
| 31 | + valid_severity = ("Info", "Low", "Medium", "High", "Critical") |
| 32 | + return severity in valid_severity |
| 33 | + |
| 34 | + |
| 35 | +def cleanup_openvas_text(text: str) -> str: |
| 36 | + """Removes unnessesary defectojo newlines""" |
| 37 | + return text.replace("\n ", " ") |
| 38 | + |
| 39 | + |
| 40 | +def escape_restructured_text(text: str) -> str: |
| 41 | + """Changes text so that restructured text symbols are not interpreted""" |
| 42 | + # OpenVAS likes to include markdown like tables in some fields |
| 43 | + # Defectdojo uses reStructuredText which causes them to be rendered wrong |
| 44 | + text = text.replace("```", "") |
| 45 | + text = text.replace("```", "") |
| 46 | + return f"```\n{text}\n```" |
| 47 | + |
| 48 | + |
| 49 | +def postprocess_finding(finding: Finding, aux_info: OpenVASFindingAuxData): |
| 50 | + """Update finding with AuxData content""" |
| 51 | + if aux_info.openvas_result: |
| 52 | + finding.steps_to_reproduce = escape_restructured_text(cleanup_openvas_text(aux_info.openvas_result)) |
| 53 | + if aux_info.summary: |
| 54 | + finding.description += f"\n**Summary**: {cleanup_openvas_text(aux_info.summary)}" |
| 55 | + if aux_info.qod: |
| 56 | + finding.description += f"\n**QoD**: {aux_info.qod}" |
| 57 | + if len(aux_info.references) > 0: |
| 58 | + finding.references = "\n".join(["- " + ref for ref in aux_info.references]) |
| 59 | + # fallback in case no cvss version is detected |
| 60 | + if aux_info.fallback_cvss_score and not finding.cvssv3_score and not finding.cvssv4_score: |
| 61 | + finding.cvssv3_score = aux_info.fallback_cvss_score |
| 62 | + |
| 63 | + # heuristic for fixed-available detection |
| 64 | + if finding.mitigation: |
| 65 | + search_terms = ["Update to version", "The vendor has released updates"] |
| 66 | + if any(text in finding.mitigation for text in search_terms): |
| 67 | + finding.fix_available = True |
| 68 | + |
| 69 | + |
| 70 | +def deduplicate(dupes: dict[str, Finding], finding: Finding): |
| 71 | + """Combine multiple openvas findings into one defectdojo finding with potentially multiple endpoints""" |
| 72 | + finding_hash = gen_finding_hash(finding) |
| 73 | + |
| 74 | + if finding_hash not in dupes: |
| 75 | + dupes[finding_hash] = finding |
| 76 | + else: |
| 77 | + # OpenVas does not combine multiple findings into one |
| 78 | + # e.g if 2 vulnerable java runtimes are present on the host this is reported as 2 finding. |
| 79 | + # The only way do differantiate theese findings when they are based on the same vulnerabilty |
| 80 | + # is the data in mapped to steps to reproduce. |
| 81 | + # However we cannot hash this field as it can contain data that changes between scans |
| 82 | + # e.g timestamps or packet ids |
| 83 | + # we therfore combine them into one defectdojo finding because duplicates during reimport cause |
| 84 | + # https://github.com/DefectDojo/django-DefectDojo/issues/3958 |
| 85 | + org = dupes[finding_hash] |
| 86 | + org.nb_occurences += 1 |
| 87 | + if org.steps_to_reproduce != finding.steps_to_reproduce: |
| 88 | + if "Endpoint" in org.steps_to_reproduce: |
| 89 | + org.steps_to_reproduce += "\n---------------------------------------\n" |
| 90 | + org.steps_to_reproduce += f"**Endpoint**: {finding.unsaved_endpoints[0].host}\n" |
| 91 | + org.steps_to_reproduce += finding.steps_to_reproduce |
| 92 | + else: |
| 93 | + tmp = org.steps_to_reproduce |
| 94 | + org.steps_to_reproduce = f"**Endpoint**: {org.unsaved_endpoints[0].host}\n" |
| 95 | + org.steps_to_reproduce += tmp |
| 96 | + |
| 97 | + # combine identical findings on different hosts into one with multiple hosts |
| 98 | + endpoint = finding.unsaved_endpoints[0] |
| 99 | + if endpoint not in org.unsaved_endpoints: |
| 100 | + org.unsaved_endpoints += finding.unsaved_endpoints |
| 101 | + |
| 102 | + |
| 103 | +def gen_finding_hash(finding: Finding) -> str: |
| 104 | + """Generate a hash for a finding that is used for deduplication of findings inside the current report""" |
| 105 | + endpoint = finding.unsaved_endpoints[0] |
| 106 | + hash_data = [ |
| 107 | + str(endpoint), |
| 108 | + finding.title, |
| 109 | + finding.vuln_id_from_tool, |
| 110 | + finding.severity, |
| 111 | + ] |
| 112 | + return hashlib.sha256("|".join(hash_data).encode("utf-8")).hexdigest() |
0 commit comments