xaitax / sploitscan Goto Github PK

    descriptions = cve_item.get("descriptions", [])
    description = next(
        (desc["value"] for desc in descriptions if desc["lang"] == "en"),
        "No description available",
    )

    metrics = cve_item.get("metrics", {})
    baseScore = baseSeverity = vectorString = "N/A"

    # First try to get CVSS v3*
    for key, value in metrics.items():
        if key.startswith("cvssMetricV3"):
            cvss_data = value[0].get("cvssData", {})
            baseScore = cvss_data.get("baseScore", "N/A")
            baseSeverity = cvss_data.get("baseSeverity", "N/A")
            vectorString = cvss_data.get("vectorString", "N/A")
            break  # Stop at the first occurrence

    # If CVSS v3* is not available, try to get CVSS v2
    if baseScore == "N/A":
        for key, value in metrics.items():
            if key.startswith("cvssMetricV2"):
                cvss_data = value[0].get("cvssData", {})
                baseScore = cvss_data.get("baseScore", "N/A")
                baseSeverity = cvss_data.get("baseSeverity", "N/A")
                vectorString = cvss_data.get("vectorString", "N/A")
                break  # Stop at the first occurrence

    label_width = max(
        len("Description:"),
        len("Published:"),
        len("Base Score:"),
        len("Base Severity:"),
        len("Vector String:"),
    )
    description_label = "Description:".ljust(label_width)
    published_label = "Published:".ljust(label_width)
    base_score_label = "Base Score:".ljust(label_width)
    base_severity_label = "Base Severity:".ljust(label_width)
    vector_string_label = "Vector String:".ljust(label_width)

    print(
        f"\n{description_label} {description}\n"
        f"{published_label} {published}\n"
        f"{base_score_label} {baseScore}\n"
        f"{base_severity_label} {baseSeverity}\n"
        f"{vector_string_label} {vectorString}\n"
    )
else:
    print("\n❌ No NVD data found for this CVE ID.\n")`

try:
    if file_path.endswith('.csv'):
        data = pd.read_csv(file_path)
    elif file_path.endswith('.xlsx'):
        data = pd.read_excel(file_path)
    elif file_path.endswith('.json'):
        data = pd.read_json(file_path)
    else:
        with open(file_path, 'r') as file:
            data = file.read()

    cves_found = re.findall(cve_pattern, str(data))

    cve_ids.update(cves_found)

except Exception as e:
    print(f"Erro ao ler o arquivo: {e}")

return cve_ids`

def load_config():
    default_config = {"vulncheck_api_key": None, "openai_api_key": None}
    base_path = os.path.dirname(os.path.abspath(__file__))
    config_paths = [
        os.path.join(base_path, "config.json"),
        os.path.expanduser("~/.sploitscan/config.json"),
        os.path.expanduser("~/.config/sploitscan/config.json"),
        "/etc/sploitscan/config.json",
    ]

    for config_path in config_paths:
        if os.path.exists(config_path):
            try:
                print(f"Attempting to load config file from: {config_path}")  # Debugging statement
                with open(config_path, "r", encoding="utf-8") as file:
                    config = json.load(file)
                    print(f"Successfully loaded config file: {config_path}")  # Debugging statement
                    return config
            except json.JSONDecodeError as e:
                print(f"⚠️ Error decoding JSON from the config file {config_path}: {e}")
            except Exception as e:
                print(f"⚠️ Unexpected error reading config file {config_path}: {e}")
    
    print("⚠️ Config file not found in any checked locations, using default settings.")
    return default_config

❯ sploitscan CVE-2024-5535

███████╗██████╗ ██╗      ██████╗ ██╗████████╗███████╗ ██████╗ █████╗ ███╗   ██╗
██╔════╝██╔══██╗██║     ██╔═══██╗██║╚══██╔══╝██╔════╝██╔════╝██╔══██╗████╗  ██║
███████╗██████╔╝██║     ██║   ██║██║   ██║   ███████╗██║     ███████║██╔██╗ ██║
╚════██║██╔═══╝ ██║     ██║   ██║██║   ██║   ╚════██║██║     ██╔══██║██║╚██╗██║
███████║██║     ███████╗╚██████╔╝██║   ██║   ███████║╚██████╗██║  ██║██║ ╚████║
╚══════╝╚═╝     ╚══════╝ ╚═════╝ ╚═╝   ╚═╝   ╚══════╝ ╚═════╝╚═╝  ╚═╝╚═╝  ╚═══╝
v0.10.3 / Alexander Hagenah / @xaitax / [email protected]

╔═══════════════════════╗
║ CVE ID: CVE-2024-5535 ║
╚═══════════════════════╝

┌───[ 🔍 Vulnerability information ]
|
├ Published:   2024-06-27
├ Base Score:  N/A (N/A)
├ Vector:      N/A
└ Description: 

[…]

┌───[ ♾️  Exploit Prediction Score (EPSS) ]
|
└ EPSS Score:  0.04% Probability of exploitation.

┌───[ 🛡️  CISA KEV Catalog ]
|
└ ❌ No data found.

Traceback (most recent call last):
  File "/usr/bin/sploitscan", line 8, in <module>
    sys.exit(cli())
             ^^^^^
  File "/usr/lib/python3/dist-packages/sploitscan/sploitscan.py", line 1067, in cli
    main(args.cve_ids, args.export, args.import_file, args.type, args.config, args.debug)
  File "/usr/lib/python3/dist-packages/sploitscan/sploitscan.py", line 984, in main
    public_exploits = fetch_and_display_public_exploits(cve_id)
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/sploitscan/sploitscan.py", line 880, in fetch_and_display_public_exploits
    display_public_exploits(github_data, vulncheck_data, exploitdb_data, packetstorm_data, nuclei_data, vulncheck_error)
  File "/usr/lib/python3/dist-packages/sploitscan/sploitscan.py", line 365, in display_public_exploits
    exploits, total = template(True)
    ^^^^^^^^^^^^^^^
ValueError: not enough values to unpack (expected 2, got 1)

Traceback (most recent call last):
  File "/usr/bin/sploitscan", line 31, in <module>
    main(args.cve_ids, args.export)
  File "/usr/share/sploitscan/sploitscan.py", line 708, in main
    cve_result = collect_cve_data(cve_id)
                 ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/share/sploitscan/sploitscan.py", line 658, in collect_cve_data
    priority = calculate_priority(
               ^^^^^^^^^^^^^^^^^^^
  File "/usr/share/sploitscan/sploitscan.py", line 385, in calculate_priority
    or bool(vulncheck_data.get("data"))
            ^^^^^^^^^^^^^^^^^^
AttributeError: 'NoneType' object has no attribute 'get'

    # Procurando a CVE no campo "codes"
    cve_pattern = re.compile(r"CVE-\d{4}-\d{4,7}")
    csv_reader = csv.DictReader(exploitdb_data.splitlines())
    relevant_data = []
    for row in csv_reader:
        if cve_pattern.search(row["codes"]) and cve_id in row["codes"]:
            relevant_data.append(row)
    
    return relevant_data
    
except requests.exceptions.RequestException as e:
    print(f"❌ An error occurred fetching exploitdb data: {e}")
    return None

    for data in exploitdb_data:
        cve_id_display = cve_id
        date_published = data.get("date", "N/A")
        author = data.get("author", "N/A")
        exploit_id = data.get("id", "N/A")
        url = f"https://www.exploit-db.com/exploits/{exploit_id}"

        row = [cve_id_display, author, date_published, url]
        table.append(row)

    print(tabulate(table, headers=headers, tablefmt="fancy_grid") + "\n")
else:
    print("No ExploitDB data found.\n")`