Handle Generic CPEs for "Running On" Configurations

[GabrielEValenzuela]

Related issue
#23149

Objetive

This PR aims to enhance the vulnerability scanner by incorporating logic to accurately handle generic Windows CPEs, especially in "running on" configurations as specified by the NVD. The objective is to improve the scanner's ability to assess vulnerabilities more precisely in environments where specific version details are not available but a generic classification is.

Changes Implemented

• Enhanced Logic in oscpe-global:

  • Added logic to handle the template of oscpe-global.json to facilitate reverse mapping from platform to vendor using feed-global.json.

• Updates to osDataCache.hpp:

  • Integrated support for new generic CPEs in the cache system to enhance matching capabilities.

• New Functionality in scanContext.hpp:

  • Implemented buildCPENameForGenericOrRunning to construct CPE names based on information received from syscollector messages.

• Improvements in packageScanner.hpp:

  • Enhanced log messages for better clarity and troubleshooting.
  • Added logic to handle comparisons involving generic CPEs, improving the accuracy of vulnerability assessments.

Implementation Details

• Modified JSON parsing logic and data structures to support the inclusion of new generic CPEs.
• Updated schema definitions in oscpe-global.json to align with the enhanced functionality.
• Conducted extensive unit and integration testing to ensure accurate CPE generation and comparison under various scenarios.

Testing

• Implemented automated tests to verify the correct functioning of the new logic across different modules (osDataCache.hpp, scanContext.hpp, and packageScanner.hpp).
• Performed regression testing to ensure that existing functionalities are not adversely affected by the new updates.
• Conducted manual testing with simulated syscollector messages to validate the effectiveness of CPE name construction.

Additional Information

• Documentation has been updated to reflect the new capabilities and guide users on how to leverage the enhanced features effectively.

---

[sebasfalcone]

I will take from here @GabrielEValenzuela

[sebasfalcone]

Update

• The target branch changed from 4.8.0 to 4.9.0
• Still waiting for 4.8.0 to be merged into 4.9.0

[sebasfalcone]

Good work @GabrielEValenzuela!

Please add an efficacy test for this scenario

[GabrielEValenzuela]

Update

With local changes, test 🟢

❯ python -m pytest  -xvv -k "run_process_and_monitor_log14"  wazuh_modules/vulnerability_scanner/qa
==================================================================================== test session starts =====================================================================================
platform linux -- Python 3.11.9, pytest-7.2.2, pluggy-1.5.0 -- /home/gvalenzuela/Documents/Work/wazuh/src/virtual_env/bin/python
cachedir: .pytest_cache
rootdir: /home/gvalenzuela/Documents/Work/wazuh/src
collected 19 items / 18 deselected / 1 selected

wazuh_modules/vulnerability_scanner/qa/test_efficacy_log.py::test_false_negatives[run_process_and_monitor_log14] PASSED                                                                [100%]

============================================================================== 1 passed, 18 deselected in 2.14s ==============================================================================

[sebasfalcone]

Simple, yet effective!

Just one thing, add the documentation for the test 20 (here is a template)

[GabrielEValenzuela]

Test case II

• After adding the content manually in the code, we run the QA tests again

❯ python -m pytest --log-cli-level=DEBUG --capture=tee-sys -xvv  wazuh_modules/vulnerability_scanner/qa/
==================================================================================== test session starts =====================================================================================
platform linux -- Python 3.11.9, pytest-7.2.2, pluggy-1.5.0 -- /home/gvalenzuela/Documents/Work/wazuh/src/virtual_env/bin/python
cachedir: .pytest_cache
rootdir: /home/gvalenzuela/Documents/Work/wazuh/src
collected 23 items
[...]
=============================================================================== 23 passed in 240.81s (0:04:00) ===============================================================================

[sebasfalcone]

Good work @GabrielEValenzuela!

• Tests 🟢
• Code 🟢

[sebasfalcone]

Missing efficacy test for the case proposed on the issues:

• https://nvd.nist.gov/vuln/detail/CVE-2012-4142