Skip to content

v0.2.0 — CVE Correlation & Enhanced Security Intelligence

Latest
Latest

Choose a tag to compare

View all tags
@rodhnin rodhnin released this 01 May 09:44
v0.2.0
2e984eb
argus-hero

Argus v0.2.0 is a major feature release. Six months after v0.1.0, this version adds real-time CVE correlation, OWASP Top 10 2021 mapping, CVSS scoring, scan diff reports, a vastly expanded aggressive mode, and a completely redesigned AI subsystem with cost tracking, streaming, multi-LLM comparison, and tool-calling agents — all on top of free, no-key-required vulnerability APIs.

What's New

CVE Correlation & Vulnerability Detection

  • argus/core/vuln_db.py — WPVulnerability.net API client (free, no API key required):
    • Real-time CVE/CWE lookup for plugins, themes, and WordPress core versions
    • CWE-based severity engine: SQL injection / RCE / file upload → Critical; XSS / CSRF / auth bypass → High
    • Version range matching with lt / lte / gt / gte operators and semver pre-release support
    • In-memory cache (1-hour TTL); graceful failure if API is unreachable
  • ARGUS-WP-012: Vulnerable plugin detected — severity auto-upgraded to critical/high based on CVE data
  • ARGUS-WP-022: Vulnerable theme detected
  • ARGUS-WP-001 enhanced: WordPress core version queried against CVE database; severity upgraded when CVEs are present

OWASP Top 10 2021 Mapping

  • argus/core/owasp.py: maps all 84 ARGUS-WP-XXX finding IDs to their OWASP Top 10 2021 category (A01–A10); applied centrally at report time
  • HTML report: purple OWASP badge per finding, links to the relevant OWASP Top 10 page

Latest Version Detection

  • WordPress.org API integration: get_plugin_latest_version() and get_theme_latest_version() — cached, graceful on failure
  • Vulnerable findings now include latest_version field with current stable release
  • HTML report: green version badge per outdated/vulnerable component

CVSS Score Enrichment

  • NVD NIST API v2.0 integration — get_cvss_score(cve_id) (free, no API key); tries V3.1 → V3.0 → V2 base score in order
  • CVSS scores fetched in parallel (max 10 CVEs per scan to respect NVD rate limits)
  • HTML report: color-coded CVSS badge per CVE — Red ≥9.0 / Orange ≥7.0 / Yellow ≥4.0 / Green <4.0

Scan Diff Reports (--diff)

  • --diff last — compare current scan against the most recent prior scan for the same domain
  • --diff <scan_id> — reference any specific scan by database ID
  • argus/core/diff.py: categorizes findings as new / fixed / persisting (matched by ARGUS-WP-XXX code)
  • Mode mismatch detection: safe vs aggressive diffs flag mode_mismatch: true with an amber warning banner in HTML
  • New top-level diff object in the JSON schema

Enhanced HTML Report

  • Severity filter bar: interactive All / Critical / High / Medium / Low / Info buttons with live counts
  • CVE badges: red pills per finding linking directly to NVD
  • CWE badges: purple pills, deduplicated across all vulnerability records for the same finding
  • CVSS score badges: color-coded inside expandable CVE detail panels
  • Latest stable version badge: green badge per outdated/vulnerable component
  • OWASP Top 10 2021 badge: purple badge per finding with link to OWASP site
  • Security header config snippets: ready-to-paste Apache / Nginx / WordPress code blocks per missing header finding
  • Expandable recommendations: truncated at 200 characters with "Show more" toggle
  • Diff section: new / fixed / persisting tables with mode mismatch warning banner

Login Security Checks (Aggressive Mode Only)

New module argus/checks/login.py:

  • ARGUS-WP-070: Login page accessibility (custom URL or block detected)
  • ARGUS-WP-071: 2FA/MFA — login page HTML scan + plugin directory probe for 13 known 2FA slugs
  • ARGUS-WP-072: CAPTCHA — reCAPTCHA v2/v3, hCaptcha, Cloudflare Turnstile, common plugins
  • ARGUS-WP-073: Brute force protection — single controlled probe
  • ARGUS-WP-074: Open user registration detection
  • ARGUS-WP-075: Password policy — plugin / strength meter JS / no enforcement

Web Crawl & Content Discovery (Aggressive Mode Only)

New module argus/checks/crawl.py:

  • ARGUS-WP-080: robots.txt — flags sensitive Disallow paths, ignores standard WP paths
  • ARGUS-WP-081: sitemap.xml — parses XML <loc> entries and flags security-relevant URLs
  • ARGUS-WP-082: HTML comment extraction — regex scan for 40+ sensitive keywords
  • ARGUS-WP-083: Link crawl (depth 1, up to 50 links) — flags interesting internal paths

Aggressive Mode Enhancements

Safe Aggressive
Plugins 100 447
Themes 25 43
File paths 74 437
Rate limit 5 req/s 10 req/s
Threads floor — 10

AI Enhancements

  • AI cost tracking: AICostTracker calculates real token cost per scan; saved to ~/.argos/costs.json and ai_costs DB table
  • --ai-budget USD: enforce maximum cost per scan; warns at 80%, aborts if exceeded
  • --ai-stream: stream AI tokens to stdout in real time (all providers via LangChain LCEL)
  • --ai-compare PROVIDERS: run analysis through multiple providers in parallel — e.g. openai,anthropic
  • --ai-agent: agent mode with tool-calling loop — NVD CVE lookup + WPVulnerability.net search (no extra API keys)
  • --ai-provider / --ai-model: override provider and model at runtime
  • Default model changed: gpt-4-turbo-preview → gpt-4o-mini-2024-07-18 (67x cheaper, same quality for security analysis)

Automated Lab Setup

  • docker/setup-lab.sh: automates turning a fresh WordPress container into a full vulnerable demo site — installs Contact Form 7 v5.3.1 and Elementor v3.5.0 (real CVE histories), creates two enumerable users, enables open registration and debug logging

Bug Fixes

  • Vulnerability title deduplication: fixed with 4-priority title picker (WPScan advisory name → hex source name → CVE ID → API name)
  • HTML entities in vulnerability titles: fixed with html.unescape() throughout
  • Diff computed after report was saved: reordered to save findings → compute diff → save JSON/HTML
  • PHP admin tool false negatives (adminer.php, phpinfo.php): fixed with explicit keyword check
  • robots.txt false positive on /wp-content/uploads/: fixed with ROBOT_SAFE_PATHS whitelist
  • 2FA detection gap for modern plugins: fixed with plugin directory probe fallback
  • ThreadPoolExecutor capped at 5 in aggressive mode: fixed to use effective_config.max_workers directly
  • --threads override overwritten by aggressive floor: fixed with max(config.max_workers, 10)
  • rate_limit_safe mismatch between config.py (3.0) and defaults.yaml (5.0): aligned to 5.0
  • ~ not expanded in YAML paths: fixed with .expanduser() on all path fields
  • costs.json parent directory not created on first run: fixed with mkdir(parents=True, exist_ok=True)
  • Compare mode cost recorded as $0.00: fixed by summing cost_by_provider
  • Schema validation failures for 6 new ai_analysis fields: all added to schema
  • Finding ID collision between login and config checks: login reassigned to 070–075

Migration from v0.1.0

Fully backward compatible. No database migration required.

The only breaking change is the default AI model (gpt-4o-mini-2024-07-18 replaces gpt-4-turbo-preview) — if you rely on the old model, set it explicitly via --ai-model or config/defaults.yaml.

Quick Start

git clone https://github.com/rodhnin/argus-wp-watcher.git
cd argus-wp-watcher
python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt

# Safe scan
python -m argus --target https://example.com --html -v

# With scan diff
python -m argus --target https://example.com --diff last --html

# Aggressive mode (requires consent token)
python -m argus --target https://example.com --aggressive --html -v

# With AI cost tracking
python -m argus --target https://example.com --use-ai --ai-budget 0.05 --ai-stream --html

Documentation

Assets 2
Loading