[Marketplace Contribution] VulnDB - Content Pack Update #38727

xsoar-bot · 2025-02-21T14:58:04Z

Status

In Progress
Ready
In Hold - (Reason for hold)

Contributor

Auto-Generated Documentation Requiring Modification

Packs/VulnDB/Integrations/VulnDB/README.md

Video Link

Short demo video of the Pack usage. Speeds up the review. Optional but recommended. Use a video sharing service such as Google Drive or YouTube.

content-bot · 2025-02-21T14:59:50Z

Thank you for your contribution. Your generosity and caring are unrivaled! Rest assured - our content wizard @sapirshuker will very shortly look over your proposed changes.
For your convenience, here is a link to the contributions SLAs document.

content-bot · 2025-02-21T14:59:51Z

Thanks for contributing to the XSOAR marketplace. To receive credit for your generous contribution, please ask the reviewer to update your information in the pack contributors file. See more information here link

xsoar-bot · 2025-02-21T18:57:31Z

Contribution Pack Resubmitted

Contributor: @nelsandr-cigna

sapirshuker

Hey, Good job! Thank you for your contribution, please see my comments.
 In addition, please note I updated the release notes for you, please let me know if I missed something regrading the functionally you added in order to update the release notes. Also, I added some section headers since you can not change it from the UI. Please feel free to reach out to me with any questions - I'm available here or on slack :) You can add the fixes / changes by using the resubmit option resubmit-a-content-pack, or by using GitHub Codespaces - GitHub Codespaces documentation.
Thanks again! 

sapirshuker · 2025-02-23T09:22:28Z

Packs/VulnDB/Integrations/VulnDB/VulnDB.yml

+      name: vuln_id
+      required: true
+    description: Returns the PDF report for a vulnerability as generated by VulnDB.
+    name: vulndb-get-vuln-report-by-vuln-id


Since the return value is a report please follow the following conventions

sapirshuker · 2025-02-23T09:26:45Z

Packs/VulnDB/Integrations/VulnDB/VulnDB.py

+    # Parse out the filename from this return
+    report_file_name = res.headers.get('content-disposition').split(';')[1].split('"')[1]
+
+    return_results(fileResult(report_file_name, report_file))


Since the return value is a report please follow the following conventions

sapirshuker · 2025-02-23T09:27:04Z

Packs/VulnDB/Integrations/VulnDB/VulnDB.py

+    report_file = res.content
+
+    # 'content-disposition' comes back in the following format:
+    # attachment; filename="VulnDB ID 389586.pdf"; filename*=UTF-8''VulnDB%20ID%20389586.pdf


Make sure there is no sensitive information here or replace any sensitive information with dummy values.

Confirmed that is not sensitive/internal information. VulnDB is built around those integer IDs, any VulnDB customer could see the same report ID.

sapirshuker · 2025-02-23T09:28:22Z

Packs/VulnDB/Integrations/VulnDB/VulnDB.py

+    res = client.http_file_request(f'/vulnerabilities/{vulndb_id}.pdf')
+
+    # Byte data of the result file
+    report_file = res.content


What happens if an incorrect vuln_id is used?

The user receives the following error
Failed to execute vulndb-get-vuln-report-by-vuln-id command. Error: Error in API call [406] - Not Acceptable
This is similar to the existing behaivor for the vulndb-get-vuln-by-id command which returns

Failed to execute vulndb-get-vuln-by-id command. Error: Error in API call [404] - Not Found {"error_id": 6151795, "error": "Unable to find a vulnerability with id 1234132432932928"}```

sapirshuker · 2025-02-23T09:47:12Z

Packs/VulnDB/Integrations/VulnDB/VulnDB.yml

+    description: Returns the CPE(s) for a vulnerability, by VulnDB ID.
+    name: vulndb-get-cpe-by-vuln-id
+    outputs:
+    - contextPath: VulnDB.CPE


Context outputs should be in the form Product.Entity.Something.
Let's add the Entity. Maybe we can change it to ?
VulnDB.Vulnerability.CPE

sapirshuker · 2025-02-23T11:24:08Z

Packs/VulnDB/Integrations/VulnDB/VulnDB.py

@@ -60,6 +69,7 @@ def vulndb_vulnerability_to_entry(vuln):
        'SolutionDate': vuln.get('solution_date', '').rstrip('Z'),
        'DiscoveryDate': vuln.get('disclosure_date', '').rstrip('Z'),
        'ExploitPublishDate': vuln.get('exploit_publish_date', '').rstrip('Z'),
+        'TechnicalDescription': vuln.get('t_description', '')


I don't see that the changes you made are relevant to this function. I would appreciate an explanation of the significance of adding these items. If you can include relevant references, I would be grateful.

The technical description fields includes information that has been added after the initial creation of the vuln in VulnDB. This contextual information is useful for an analyst trying to determine the risk the vulnerability represents.

sapirshuker · 2025-02-23T11:24:19Z

Packs/VulnDB/Integrations/VulnDB/VulnDB.py

-
+    timeline_details = {
+        'DiscoveryDate': vuln.get('discovery_date', '').rstrip('Z'),
+        'DisclosureDate': vuln.get('disclosure_date', '').rstrip('Z'),


I don't see that the changes you made are relevant to this function. I would appreciate an explanation of the significance of adding these items. If you can include relevant references, I would be grateful.

The timeline details are the data present in this section of a VulnDB vulnerability. These are useful when determining the risk a vulnerability presents to your org by letting you know how long a vuln has been public, if/when it was exploited, whether the vendor has acknowledged the vuln, etc.

sapirshuker · 2025-02-23T11:47:42Z

Packs/VulnDB/pack_metadata.json

@@ -2,7 +2,7 @@
    "name": "VulnDB",
    "description": "Lists all of the security vulnerabilities for various products (OS,Applications) etc)",
    "support": "xsoar",
-    "currentVersion": "1.0.12",


Let's change the version revision (to 1.0.13) to according to the docs

sapirshuker · 2025-02-23T12:25:16Z

Packs/VulnDB/Integrations/VulnDB/VulnDB.yml

+    name: vulndb-get-vuln-report-by-vuln-id
+  - arguments:
+    - description: VulnDB vulnerability ID.
+      name: vuln_id


Do we have a way to retrieve the vuln_id with a command? Is there a command we can add to fetch the id?

There are several existing commands that allow the user to fetch a vuln_id including vulndb-get-vuln-by-product-id, vulndb-get-vuln-by-vendor-and-product-id, vulndb-get-vuln-by-vendor-and-product-name,vulndb-get-vuln-by-vendor-id and lastly, my new command vulndb-get-vuln-by-cve-id

sapirshuker · 2025-02-24T15:49:31Z

Packs/VulnDB/Integrations/VulnDB/VulnDB.py

+def vulndb_get_cpe_command(args: dict, client: Client):
+    vulndb_id = args['vuln_id']
+
+    res = client.http_request(f'/vulnerabilities/{vulndb_id}?show_cpe=true')


Is this filter (show_cpe=true) customized or do all users have the same? I couldn't find it in the product documentation.

That param is built into VulnDB's API (https://vulndb.flashpoint.io/documentation/api). There is a section "Pulling Vulnerability Information", that shows optional params including "show_cpe=true".

content-bot · 2025-02-24T17:15:54Z

For the Reviewer: Trigger build request has been accepted for this contribution PR.

content-bot · 2025-02-24T17:15:59Z

For the Reviewer: Successfully created a pipeline in GitLab with url: https://gitlab.xdr.pan.local/xdr/cortex-content/content/-/pipelines/2552889

xsoar-bot · 2025-02-28T16:50:39Z

Contribution Pack Resubmitted

Contributor: @nelsandr-cigna

sapirshuker · 2025-03-02T11:38:22Z

Hey @nelsandr-cigna
I see that there are still errors in pre-commit, please update me when the fix is ready for review.

CLAassistant · 2025-03-04T15:48:43Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ sapirshuker
❌ xsoar-bot
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

"contribution update to pack 'VulnDB'"

f515fbb

content-bot added Contribution Thank you! Contributions are always welcome! External PR Xsoar Support Level Indicates that the contribution is for XSOAR supported pack labels Feb 21, 2025

content-bot changed the base branch from master to contrib/xsoar-contrib_nelsandr-cigna-contrib-VulnDB February 21, 2025 14:59

content-bot assigned sapirshuker Feb 21, 2025

content-bot requested a review from sapirshuker February 21, 2025 14:59

content-bot added the Contribution Form Filled Whether contribution form filled or not. label Feb 21, 2025

pack resubmitted

33cc09b

sapirshuker added the ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. label Feb 24, 2025

sapirshuker requested changes Feb 24, 2025

View reviewed changes

content-bot removed the ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. label Feb 24, 2025

xsoar-bot added 2 commits February 28, 2025 16:50

pack resubmitted

b6cd61d

resolved rebase conflicts

85ddffd

xsoar-bot force-pushed the nelsandr-cigna-contrib-VulnDB branch from 3124a20 to 85ddffd Compare February 28, 2025 16:50

Update VulnDB.py - fix mypy pre-commit errors

0a0682c

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Marketplace Contribution] VulnDB - Content Pack Update #38727

[Marketplace Contribution] VulnDB - Content Pack Update #38727

xsoar-bot commented Feb 21, 2025

content-bot commented Feb 21, 2025

content-bot commented Feb 21, 2025

xsoar-bot commented Feb 21, 2025

sapirshuker left a comment

sapirshuker Feb 23, 2025

sapirshuker Feb 23, 2025

sapirshuker Feb 23, 2025

nelsandr-cigna Feb 26, 2025

sapirshuker Feb 23, 2025

nelsandr-cigna Feb 26, 2025

sapirshuker Feb 23, 2025

sapirshuker Feb 23, 2025

nelsandr-cigna Feb 26, 2025

sapirshuker Feb 23, 2025

nelsandr-cigna Feb 26, 2025

sapirshuker Feb 23, 2025

sapirshuker Feb 23, 2025

nelsandr-cigna Feb 26, 2025 •

edited

Loading

sapirshuker Feb 24, 2025

nelsandr-cigna Feb 26, 2025

nelsandr-cigna Feb 26, 2025 •

edited

Loading

content-bot commented Feb 24, 2025

content-bot commented Feb 24, 2025

xsoar-bot commented Feb 28, 2025

sapirshuker commented Mar 2, 2025 •

edited

Loading

CLAassistant commented Mar 4, 2025 •

edited

Loading

[Marketplace Contribution] VulnDB - Content Pack Update #38727

Are you sure you want to change the base?

[Marketplace Contribution] VulnDB - Content Pack Update #38727

Conversation

xsoar-bot commented Feb 21, 2025

Status

Contributor

Auto-Generated Documentation Requiring Modification

Video Link

content-bot commented Feb 21, 2025

content-bot commented Feb 21, 2025

xsoar-bot commented Feb 21, 2025

Contribution Pack Resubmitted

sapirshuker left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nelsandr-cigna Feb 26, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nelsandr-cigna Feb 26, 2025 • edited Loading

Choose a reason for hiding this comment

content-bot commented Feb 24, 2025

content-bot commented Feb 24, 2025

xsoar-bot commented Feb 28, 2025

Contribution Pack Resubmitted

sapirshuker commented Mar 2, 2025 • edited Loading

CLAassistant commented Mar 4, 2025 • edited Loading

nelsandr-cigna Feb 26, 2025 •

edited

Loading

nelsandr-cigna Feb 26, 2025 •

edited

Loading

sapirshuker commented Mar 2, 2025 •

edited

Loading

CLAassistant commented Mar 4, 2025 •

edited

Loading