Skip to content

Commit a0ab10f

Browse files
rsendenrsenden
committed
Added functionality for parsing CVSSv3
1 parent db5e755 commit a0ab10f

File tree

6 files changed

+105
-24
lines changed

6 files changed

+105
-24
lines changed

‎src/main/java/com/fortify/ssc/parser/owasp/dependencycheck/CustomVulnAttribute.java‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,11 @@ public enum CustomVulnAttribute implements com.fortify.plugin.spi.VulnerabilityA
1919
name(AttrType.STRING),
2020
cveUrl(AttrType.STRING),
2121
notes(AttrType.STRING),
22-
cvssScore(AttrType.DECIMAL),
23-
cvssAccessVector(AttrType.STRING),
24-
cvssAccessComplexity(AttrType.STRING),
25-
cvssConfidentialImpact(AttrType.STRING),
22+
cvssVersion(AttrType.STRING),
23+
cvssBaseScore(AttrType.DECIMAL),
24+
cvssAttackVector(AttrType.STRING),
25+
cvssAttackComplexity(AttrType.STRING),
26+
cvssConfidentialityImpact(AttrType.STRING),
2627
cvssIntegrityImpact(AttrType.STRING),
2728
cvssAvailabilityImpact(AttrType.STRING),
2829
cwes(AttrType.STRING),

‎src/main/java/com/fortify/ssc/parser/owasp/dependencycheck/domain/CVSSv2.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,4 +36,7 @@ public final class CVSSv2 {
3636
@JsonProperty private String confidentialImpact;
3737
@JsonProperty private String integrityImpact;
3838
@JsonProperty private String availabilityImpact;
39+
40+
// Available in JSON, but currently not used/shown by plugin
41+
//@JsonProperty private String severity;
3942
}

‎src/main/java/com/fortify/ssc/parser/owasp/dependencycheck/domain/CVSSv3.java‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
/*******************************************************************************
2+
* (c) Copyright 2020 Micro Focus or one of its affiliates
3+
*
4+
* Permission is hereby granted, free of charge, to any person obtaining a
5+
* copy of this software and associated documentation files (the
6+
* "Software"), to deal in the Software without restriction, including without
7+
* limitation the rights to use, copy, modify, merge, publish, distribute,
8+
* sublicense, and/or sell copies of the Software, and to permit persons to
9+
* whom the Software is furnished to do so, subject to the following
10+
* conditions:
11+
*
12+
* The above copyright notice and this permission notice shall be included
13+
* in all copies or substantial portions of the Software.
14+
*
15+
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY
16+
* KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
17+
* WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
18+
* PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19+
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
20+
* DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
21+
* CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
22+
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
23+
* IN THE SOFTWARE.
24+
******************************************************************************/
25+
package com.fortify.ssc.parser.owasp.dependencycheck.domain;
26+
27+
import com.fasterxml.jackson.annotation.JsonProperty;
28+
29+
import lombok.Getter;
30+
31+
@Getter
32+
public final class CVSSv3 {
33+
@JsonProperty private Float baseScore;
34+
@JsonProperty private String attackVector;
35+
@JsonProperty private String attackComplexity;
36+
@JsonProperty private String confidentialityImpact;
37+
@JsonProperty private String integrityImpact;
38+
@JsonProperty private String availabilityImpact;
39+
40+
// Available in JSON, but currently not used/shown by plugin
41+
//@JsonProperty private String privilegesRequired;
42+
//@JsonProperty private String userInteraction;
43+
//@JsonProperty private String scope;
44+
//@JsonProperty private String baseSeverity;
45+
46+
public static final CVSSv3 fromCvssv2(CVSSv2 cvssv2) {
47+
CVSSv3 result = new CVSSv3();
48+
result.baseScore = cvssv2.getScore();
49+
result.attackVector = cvssv2.getAccessVector();
50+
result.attackComplexity = cvssv2.getAccessComplexity();
51+
result.confidentialityImpact = cvssv2.getConfidentialImpact();
52+
result.integrityImpact = cvssv2.getIntegrityImpact();
53+
result.availabilityImpact = cvssv2.getAvailabilityImpact();
54+
return result;
55+
}
56+
}

‎src/main/java/com/fortify/ssc/parser/owasp/dependencycheck/domain/Vulnerability.java‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,4 +37,17 @@ public final class Vulnerability {
3737
@JsonProperty private String notes;
3838
@JsonProperty private String[] cwes;
3939
@JsonProperty private CVSSv2 cvssv2;
40+
@JsonProperty private CVSSv3 cvssv3;
41+
42+
public String getCvssVersion() {
43+
return cvssv3!=null ? "3"
44+
: cvssv2!=null ? "2"
45+
: "None";
46+
}
47+
48+
public CVSSv3 getCvssAsv3() {
49+
return cvssv3!=null ? cvssv3
50+
: cvssv2!=null ? CVSSv3.fromCvssv2(cvssv2)
51+
: null;
52+
}
4053
}

‎src/main/java/com/fortify/ssc/parser/owasp/dependencycheck/parser/VulnerabilitiesParser.java‎

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
import com.fortify.plugin.api.StaticVulnerabilityBuilder;
1515
import com.fortify.plugin.api.VulnerabilityHandler;
1616
import com.fortify.ssc.parser.owasp.dependencycheck.CustomVulnAttribute;
17-
import com.fortify.ssc.parser.owasp.dependencycheck.domain.CVSSv2;
17+
import com.fortify.ssc.parser.owasp.dependencycheck.domain.CVSSv3;
1818
import com.fortify.ssc.parser.owasp.dependencycheck.domain.Dependency;
1919
import com.fortify.ssc.parser.owasp.dependencycheck.domain.Vulnerability;
2020
import com.fortify.util.ssc.parser.EngineTypeHelper;
@@ -77,26 +77,27 @@ private final void buildVulnerability(Dependency dependency, Vulnerability vulne
7777
vb.setPriority(Priority.Medium);
7878
}
7979

80-
CVSSv2 cvss = vulnerability.getCvssv2();
81-
if ( cvss!=null ) {
82-
vb.setImpact(cvss.getScore()==null
80+
CVSSv3 cvssv3 = vulnerability.getCvssAsv3();
81+
if ( cvssv3!=null ) {
82+
vb.setImpact(cvssv3.getBaseScore()==null
8383
? 2.5f // Default value if not defined in JSON
84-
: (cvss.getScore()/10*5)); // CVVS2 score is 0-10, SSC impact is 0-5
84+
: (cvssv3.getBaseScore()/10*5)); // CVVS3 score is 0-10, SSC impact is 0-5
8585

86-
if ( StringUtils.equalsIgnoreCase("LOW", cvss.getAccessComplexity()) ) {
86+
if ( StringUtils.equalsIgnoreCase("LOW", cvssv3.getAttackComplexity()) ) {
8787
vb.setProbability(0f);
88-
} else if ( StringUtils.equalsIgnoreCase("HIGH", cvss.getAccessComplexity()) ) {
88+
} else if ( StringUtils.equalsIgnoreCase("HIGH", cvssv3.getAttackComplexity()) ) {
8989
vb.setProbability(5.0f);
9090
} else {
9191
vb.setProbability(2.5f);
9292
}
9393

94-
vb.setDecimalCustomAttributeValue(CustomVulnAttribute.cvssScore, cvss.getScore()==null?null:new BigDecimal(cvss.getScore().toString()));
95-
vb.setStringCustomAttributeValue(CustomVulnAttribute.cvssAccessVector, cvss.getAccessVector());
96-
vb.setStringCustomAttributeValue(CustomVulnAttribute.cvssAccessComplexity, cvss.getAccessComplexity());
97-
vb.setStringCustomAttributeValue(CustomVulnAttribute.cvssConfidentialImpact, cvss.getConfidentialImpact());
98-
vb.setStringCustomAttributeValue(CustomVulnAttribute.cvssIntegrityImpact, cvss.getIntegrityImpact());
99-
vb.setStringCustomAttributeValue(CustomVulnAttribute.cvssAvailabilityImpact, cvss.getAvailabilityImpact());
94+
vb.setStringCustomAttributeValue(CustomVulnAttribute.cvssVersion, vulnerability.getCvssVersion());
95+
vb.setDecimalCustomAttributeValue(CustomVulnAttribute.cvssBaseScore, cvssv3.getBaseScore()==null?null:new BigDecimal(cvssv3.getBaseScore().toString()));
96+
vb.setStringCustomAttributeValue(CustomVulnAttribute.cvssAttackVector, cvssv3.getAttackVector());
97+
vb.setStringCustomAttributeValue(CustomVulnAttribute.cvssAttackComplexity, cvssv3.getAttackComplexity());
98+
vb.setStringCustomAttributeValue(CustomVulnAttribute.cvssConfidentialityImpact, cvssv3.getConfidentialityImpact());
99+
vb.setStringCustomAttributeValue(CustomVulnAttribute.cvssIntegrityImpact, cvssv3.getIntegrityImpact());
100+
vb.setStringCustomAttributeValue(CustomVulnAttribute.cvssAvailabilityImpact, cvssv3.getAvailabilityImpact());
100101
}
101102

102103
String[] cwes = vulnerability.getCwes();

‎src/main/resources/viewtemplate/OWASPDependencyCheckTemplate.json‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -60,34 +60,41 @@
6060
[
6161
{
6262
"type": "template",
63-
"title": "CVSS 2.0",
63+
"title": "CVSS",
6464
"templateId": "TITLEBOX",
6565
"items": [
66+
{
67+
"type": "template",
68+
"title": "CVSS Version",
69+
"key": "customAttributes.cvssVersion",
70+
"templateId": "SIMPLE",
71+
"dataType": "string"
72+
},
6673
{
6774
"type": "template",
6875
"title": "Score",
69-
"key": "customAttributes.cvssScore",
76+
"key": "customAttributes.cvssBaseScore",
7077
"templateId": "SIMPLE",
7178
"dataType": "string"
7279
},
7380
{
7481
"type": "template",
75-
"title": "Access Vector",
76-
"key": "customAttributes.cvssAccessVector",
82+
"title": "Attack Vector",
83+
"key": "customAttributes.cvssAttackVector",
7784
"templateId": "SIMPLE",
7885
"dataType": "string"
7986
},
8087
{
8188
"type": "template",
82-
"title": "Access Complexity",
83-
"key": "customAttributes.cvssAccessComplexity",
89+
"title": "Attack Complexity",
90+
"key": "customAttributes.cvssAttackComplexity",
8491
"templateId": "SIMPLE",
8592
"dataType": "string"
8693
},
8794
{
8895
"type": "template",
8996
"title": "Confidentiality Impact",
90-
"key": "customAttributes.cvssConfidentialImpact",
97+
"key": "customAttributes.cvssConfidentialityImpact",
9198
"templateId": "SIMPLE",
9299
"dataType": "string"
93100
},

0 commit comments

Comments
 (0)