Vulnerability Scan not picking up vulnerable software.

[Matty Matt]

Can't figure out what i am doing wrong, to be able to detect vulnerable versions of Foxit PhantomPDF.

GET /syscollector/010/packages

Added to /var/ossec/queue/vulnerabilities/dictionaries/cpe_helper.json

Modified the update_date in cpe_helper.json

systemctl stop wazuh-manager

sqlite3 /var/ossec/queue/vulnerabilities/cve.db "DELETE FROM METADATA WHERE TARGET='CPEW';"

sqlite3 /var/ossec/queue/db/010.db "UPDATE vuln_metadata SET LAST_FULL_SCAN = 0;"

systemctl start wazuh-manager

Wait for Scan to finish

GET /vulnerability/010

 

I can see various entries for foxit in the /var/ossec/queue/vulnerabilities/cve.db

 

Just can't seem to get Wazuh to detect it. Just missing a step or are my additions to cpe_helper.json not correct. Any help would be appreciated.

Thanks

[John E]

Hello Matty,

Based on the CPE documentation here: https://documentation.wazuh.com/current/user-manual/capabilities/vulnerability-detection/cpe-helper.html

Your entry for  /var/ossec/queue/vulnerabilities/dictionaries/cpe_helper.json should be something like the below.

{
    "target": "windows",
    "source": {
        "vendor": [
            "Foxit Software Inc."
        ],
        "product": [
            "Foxit PhantomPDF"
        ],
        "version": []
    },
    "translation": {
        "vendor": [
            "foxitsoftware"
        ],
        "product": [
            "phantompdf"
        ],
        "version": []
    },
    "action": [
        "replace_vendor",
        "replace_product"
    ]
}

[Matty Matt]

Hi John E,

I struggled with mapping the NVD to the CPE file for a while now, even after reading the documentation several times, i just couldn't get it to work.

I finally understand it now, thanks to your example.

Many thanks

Matty

[Matty Matt]

Hi John E,

I may have jumped the gun - i am trying to add Foxit Version 12.1, this is what i have at the moment

Which if i search the NVD database for a match i get this

So i modify the cpe_helper.json file to the following

Searching the cve.db I can see Foxit PDF Editor.

But if i query the agent for vulnerabilities, i get no vulnerabilities found.

I've looked at the cpe_helper.json file, and i don't see an example where there is one Vendor name that goes to two vendor translations, I've tried replace_vendor, replace_vendor_if matches (like the skype example)

I am i still doing something wrong?

Again, any pointers you can provide are greatly appreciated.

Thanks

Matty

[John E]

Hello Matty,

Looking to this, will provide a response shortly.

[John E]

Hello Matty,

Alright so i tried to replicate this, although i was only able to install Foxit PDF Editor.

Something to note is that the format of the CPE reported by NVD must match the name and version in the system inventory.

The version reported for your Foxit PDF Editor is 12.1.3.15356, and this does not match explicitly any vulnerable version in the NVD database.

Going through the most recent vulnerable version captured by NVD https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:foxit:pdf_editor:12.1:*:*:*:*:*:*:*

the summary shows that the issue was fixed in 12.1.2. And you have a newer version.