Class: Intrigue::Ident::Cpe

Inherits:
Object
  • Object
show all
Defined in:
lib/cpe.rb

Instance Method Summary collapse

Constructor Details

#initialize(cpe_string) ⇒ Cpe

Returns a new instance of Cpe.



7
8
9
10
11
12
13
14
15
16
 
# File 'lib/cpe.rb', line 7

def initialize(cpe_string)
  @cpe = cpe_string
  x = _parse_cpe(@cpe)

  return nil unless x

  @vendor = x[:vendor]
  @product = x[:product]
  @version = x[:version]
end

Instance Method Details

#<(another) ⇒ Object 



18
19
20
 
# File 'lib/cpe.rb', line 18

def <(another)
  Gem::Version(@version) < Gem::Version(_parse_cpe(another[:version]))
end

#>(another) ⇒ Object 



22
23
24
 
# File 'lib/cpe.rb', line 22

def >(another)
  Gem::Version(@version) > Gem::Version(_parse_cpe(another[:version]))
end

#vulns ⇒ Object

hacktastic! matches vulns by CPE



27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
 
# File 'lib/cpe.rb', line 27

def vulns
  return unless @version
  puts "Matching vulns to #{@cpe}: #{@version}"
  vulns = []
  basedir="#{File.expand_path File.dirname(__FILE__)}"
  files = [
    "#{basedir}/../data/nvd/nvdcve-1.0-2018.json"]
    #      "#{basedir}/../data/nvd/nvdcve-1.0-2016.json",
    #      "#{basedir}/../data/nvd/nvdcve-1.0-2015.json"

  files.each do |f|
    puts "Checking file: #{f}"
    next unless File.exist? f
    json = JSON.parse(File.open(f,"r").read)
    json["CVE_Items"].each do |v|
      v = v["cve"]

      # data sanity check
      next unless v["affects"] && v["affects"]["vendor"] && v["affects"]["vendor"]["vendor_data"]

      # check to make sure it includes our vendor
      next unless v["affects"]["vendor"]["vendor_data"].map{|x| x["vendor_name"].downcase }.include? @vendor.downcase

      # iterate through the heirarchy to get to product and version we can match on
      v["affects"]["vendor"]["vendor_data"].each do |vd|
        vd["product"]["product_data"].each do |p|
          p["version"]["version_data"].each do |vd|
            next unless p["product_name"].downcase == @product.downcase
            vulns << v if vd["version_value"] =~ /#{@version}/
          end
        end
      end

    end
  end
  puts "Sending #{vulns.uniq.count} vulns"
vulns.uniq
end