Merge pull request #795 from ziadhany/add_fireeye

Add fireeye vulnerabilities #487

vulnerabilities/importers/__init__.py

@@ -14,6 +14,7 @@
 from vulnerabilities.importers import debian
 from vulnerabilities.importers import debian_oval
 from vulnerabilities.importers import elixir_security
+from vulnerabilities.importers import fireeye
 from vulnerabilities.importers import gentoo
 from vulnerabilities.importers import github
 from vulnerabilities.importers import gitlab
@@ -61,6 +62,7 @@
     apache_tomcat.ApacheTomcatImporter,
     xen.XenImporter,
     ubuntu_usn.UbuntuUSNImporter,
+    fireeye.FireyeImporter,
 ]
 
 IMPORTERS_REGISTRY = {x.qualified_name: x for x in IMPORTERS_REGISTRY}

vulnerabilities/importers/fireeye.py

@@ -0,0 +1,134 @@
+#
+# Copyright (c) nexB Inc. and others. All rights reserved.
+# VulnerableCode is a trademark of nexB Inc.
+# SPDX-License-Identifier: Apache-2.0
+# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
+# See https://github.com/nexB/vulnerablecode for support or download.
+# See https://aboutcode.org for more information about nexB OSS projects.
+#
+import logging
+import re
+from pathlib import Path
+from typing import Iterable
+from typing import List
+
+from vulnerabilities.importer import AdvisoryData
+from vulnerabilities.importer import GitImporter
+from vulnerabilities.importer import Reference
+from vulnerabilities.utils import build_description
+from vulnerabilities.utils import dedupe
+
+logger = logging.getLogger(__name__)
+
+
+class FireyeImporter(GitImporter):
+    spdx_license_expression = "CC-BY-SA-4.0 AND MIT"
+    license_url = "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/README.md"
+    notice = """
+    Copyright (c) Mandiant
+    The following licenses/licensing apply to this Mandiant repository:
+    1. CC BY-SA 4.0 - For CVE related information not including source code (such as PoCs)
+    2. MIT - For source code contained within provided CVE information
+    """
+
+    def __init__(self):
+        super().__init__(repo_url="git+https://github.com/mandiant/Vulnerability-Disclosures")
+
+    def advisory_data(self) -> Iterable[AdvisoryData]:
+        self.clone()
+        files = filter(
+            lambda p: p.suffix in [".md", ".MD"], Path(self.vcs_response.dest_dir).glob("**/*")
+        )
+        for file in files:
+            if Path(file).stem == "README":
+                continue
+            try:
+                with open(file) as f:
+                    yield parse_advisory_data(f.read())
+            except UnicodeError:
+                logger.error(f"Invalid file {file}")
+
+
+def parse_advisory_data(raw_data) -> AdvisoryData:
+    """
+    Parse a fireeye advisory repo and return an AdvisoryData or None.
+    These files are in Markdown format.
+    """
+    raw_data = raw_data.replace("\n\n", "\n")
+    md_list = raw_data.split("\n")
+    md_dict = md_list_to_dict(md_list)
+
+    database_id = md_list[0][1::]
+    summary = md_dict.get(database_id[1::]) or []
+    description = md_dict.get("## Description") or []
+    impact = md_dict.get("## Impact")  # not used but can be used to get severity
+    exploit_ability = md_dict.get("## Exploitability")  # not used
+    cve_ref = md_dict.get("## CVE Reference") or []
+    tech_details = md_dict.get("## Technical Details")  # not used
+    resolution = md_dict.get("## Resolution")  # not used
+    disc_credits = md_dict.get("## Discovery Credits")  # not used
+    disc_timeline = md_dict.get("## Disclosure Timeline")  # not used
+    references = md_dict.get("## References") or []
+
+    return AdvisoryData(
+        aliases=get_aliases(database_id, cve_ref),
+        summary=build_description(" ".join(summary), " ".join(description)),
+        references=get_references(references),
+    )
+
+
+def get_references(references):
+    """
+    Return a list of Reference from a list of URL reference in md format
+    >>> get_references(["- http://1-4a.com/cgi-bin/alienform/af.cgi"])
+    [Reference(reference_id='', url='http://1-4a.com/cgi-bin/alienform/af.cgi', severities=[])]
+    >>> get_references(["- [Mitre CVE-2021-42712](https://www.cve.org/CVERecord?id=CVE-2021-42712)"])
+    [Reference(reference_id='', url='https://www.cve.org/CVERecord?id=CVE-2021-42712', severities=[])]
+    """
+    urls = []
+    for ref in references:
+        if ref.startswith("- "):
+            urls.append(matcher_url(ref[2::]))
+        else:
+            urls.append(matcher_url(ref))
+
+    return [Reference(url=url) for url in urls if url]
+
+
+def matcher_url(ref) -> str:
+    """
+    Returns URL of the reference markup from reference url in Markdown format
+    """
+    markup_regex = "\[([^\[]+)]\(\s*(http[s]?://.+)\s*\)"
+    matched_markup = re.findall(markup_regex, ref)
+    if matched_markup:
+        return matched_markup[0][1]
+    else:
+        return ref
+
+
+def get_aliases(database_id, cve_ref) -> List:
+    """
+    Returns a List of Aliases from a database_id and a list of CVEs
+    >>> get_aliases("MNDT-2021-0012",["CVE-2021-44207"])
+    ['CVE-2021-44207', 'MNDT-2021-0012']
+    """
+    cve_ref.append(database_id)
+    return dedupe(cve_ref)
+
+
+def md_list_to_dict(md_list):
+    """
+    Returns a dictionary of md_list from a list of a md file splited by \n
+    >>> md_list_to_dict(["# Header","hello" , "hello again" ,"# Header2"])
+    {'# Header': ['hello', 'hello again'], '# Header2': []}
+    """
+    md_dict = {}
+    md_key = ""
+    for md_line in md_list:
+        if md_line.startswith("#"):
+            md_dict[md_line] = []
+            md_key = md_line
+        else:
+            md_dict[md_key].append(md_line)
+    return md_dict

vulnerabilities/tests/test_data/fireeye/fireeye_test1.md

@@ -0,0 +1,41 @@
+# FEYE-2019-0002
+## Description
+GPU-Z.sys, part of the GPU-Z package from TechPowerUp, exposes the wrmsr instruction to user-mode callers without properly validating the target Model Specific Register (MSR). This can result in arbitrary unsigned code being executed in Ring 0.
+
+## Impact
+High - Arbitrary Ring 0 code execution
+
+## Exploitability
+Medium/Low - Driver must be loaded or attacker will require admin rights. Newer versions require admin callers.
+
+## CVE Reference
+CVE-2019-7245 
+
+## Technical Details
+IOCTL 0x8000644C in the GPU-Z driver instructs the binary to modify a Model Specific Register (MSR) on the target system. These registers control a wide variety of system functionality and can be used to monitor CPU temperature, track branches in code, tweak voltages, etc. MSRs are also responsible for setting the kernel mode function responsible for handling system calls.
+
+The driver does not appropriately filter access to MSRs, allowing an attacker to overwrite the system call handler and run unsigned code in Ring 0. Allowing access to any of the following MSRs can result in arbitrary Ring 0 code being executed:
+
+* 0xC0000081
+* 0xC0000082
+* 0xC0000083
+* 0x174
+* 0x175
+* 0x176
+
+For exploitation details see the INFILTRATE presentation in the references.
+
+## Resolution
+This issue is fixed in v2.23.0: [https://www.techpowerup.com/257995/techpowerup-releases-gpu-z-v2-23-0](https://www.techpowerup.com/257995/techpowerup-releases-gpu-z-v2-23-0)
+
+## Discovery Credits
+Ryan Warns
+
+## Disclosure Timeline
+- 2 February 2019 - Contacted vendor
+- 2 February 2019 - Vendor response, confirmation of issue
+- 25 July 2019 - Vendor confirmed fix
+- 6 August 2019 - Fixed version released
+
+## References 
+[Exploitation Details](https://downloads.immunityinc.com/infiltrate2019-slidepacks/ryan-warns-timothy-harrison-device-driver-debauchery-msr-madness/MSR_Madness_v2.9_INFILTRATE.pptx)

vulnerabilities/tests/test_data/fireeye/fireeye_test1_expect.json

@@ -0,0 +1,11 @@
+{
+  "aliases": [
+    "CVE-2019-7245 ",
+    " FEYE-2019-0002"
+  ],
+  "summary": "GPU-Z.sys, part of the GPU-Z package from TechPowerUp, exposes the wrmsr instruction to user-mode callers without properly validating the target Model Specific Register (MSR). This can result in arbitrary unsigned code being executed in Ring 0.",
+  "affected_packages": [],
+  "references": [],
+  "date_published": null,
+  "weaknesses": []
+}

vulnerabilities/tests/test_data/fireeye/fireeye_test2.md

@@ -0,0 +1,41 @@
+# FEYE-2020-0020
+## Description
+
+Digi International's ConnectPort X2e is susceptible to a local privilege escalation vulnerable to the privileged user `root`. 
+
+## Impact
+High - An attacker with remote network access to a X2e could remotely compromise the device. This could be used to install malware, modify system behavior, or stage a more serious attack.
+
+## Exploitability
+Medium - An attacker would need to read and write files as the system user python. On production devices, this can be accomplished remotely by establishing an SSH connection or access via a TTY. 
+
+## CVE Reference
+CVE-2020-12878
+
+## Technical Details
+The ConnectPort X2e performed filesystem actions as the privileged system user root on files controllable by the less-privileged user python. A malicious attacker could use this to escalate privileges from the local user `python` user to `root`.
+
+Mandiant determined that the user `root` executed the file `/etc/init.d/S50dropbear.sh` during normal system boot. The shell script performed a `chown` on the directory `/WEB/python/.ssh/`, which was writable as the user `python`. 
+
+To exploit this, Mandiant used Linux symbolic links to force the system to set the ownership of the directory `/etc/init.d/` to `python:python`. Mandiant could then create a malicious `init` script in the `/etc/init.d/` directory that would be executed by `root` on future system boots. 
+
+## Resolution
+Digi International has fixed the reported vulnerability in [version 3.2.30.6](https://ftp1.digi.com/support/firmware/93001304_D.pdf) (May 2020) of the ConnectPort X2e software. 
+
+## Discovery Credits
+- Jake Valletta, FireEye Mandiant
+- Sam Sabetan, FireEye Mandiant
+
+## Disclosure Timeline
+
+- 13 February 2020 - Issue reported to vendor
+- 11 March 2020 - Issue confirmed by Digi International
+- 14 May 2020 - CVE reserved with MITRE
+- May 2020 - Digi Releases Patch
+- 17 February 2021 - FireEye Mandiant advisory published
+
+## References
+
+- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12878
+- https://www.fireeye.com/blog/threat-research/2021/02/solarcity-exploitation-of-x2e-iot-device-part-one.html
+- https://www.fireeye.com/blog/threat-research/2021/02/solarcity-exploitation-of-x2e-iot-device-part-two.html

vulnerabilities/tests/test_data/fireeye/fireeye_test2_expect.json

@@ -0,0 +1,27 @@
+{
+  "aliases": [
+    "CVE-2020-12878",
+    " FEYE-2020-0020"
+  ],
+  "summary": "Digi International's ConnectPort X2e is susceptible to a local privilege escalation vulnerable to the privileged user `root`.",
+  "affected_packages": [],
+  "references": [
+    {
+      "reference_id": "",
+      "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12878",
+      "severities": []
+    },
+    {
+      "reference_id": "",
+      "url": "https://www.fireeye.com/blog/threat-research/2021/02/solarcity-exploitation-of-x2e-iot-device-part-one.html",
+      "severities": []
+    },
+    {
+      "reference_id": "",
+      "url": "https://www.fireeye.com/blog/threat-research/2021/02/solarcity-exploitation-of-x2e-iot-device-part-two.html",
+      "severities": []
+    }
+  ],
+  "date_published": null,
+  "weaknesses": []
+}