vulncontrol

Python script for monitoring www.cvedetails.com vulnerabilities database

Usage

$ git clone https://github.com/Amet13/vulncontrol
$ cd vulncontrol/

First go here, find your software and add links to products.txt.

Script parameters:

• -t Telegram token and ID (no usage by default)
• -d Date in format YYYY-MM-DD (today by default, it can be incorrectly works with custom data, because cvedetails has bad API)
• -m Min CVSS (by default 0)

Then you can run script in two ways.

First way without Telegram support:

$ ./vulncontrol.py
There are no available vulnerabilities at 2017-02-28

$ ./vulncontrol.py -d 2017-02-18 -m 5
CVE-2017-6074 9.3 http://www.cvedetails.com/cve/CVE-2017-6074/
CVE-2017-6001 7.6 http://www.cvedetails.com/cve/CVE-2017-6001/
CVE-2017-5986 7.1 http://www.cvedetails.com/cve/CVE-2017-5986/
Telegram alert did not sent

Second way with Telegram support:

• go to @BotFather and create /newbot, for example VulncontrolBot
• then you have token like 111111111:ABCDE...
• after go to @MyTelegramID_bot and /start it
• then you have your telegram ID like 123456789

Now you can run script with your token and ID:

$ ./vulncontrol.py -t 111111111:ABCDE 123456789
There are no available vulnerabilities at 2017-02-28

$ ./vulncontrol.py -t 111111111:ABCDE 123456789 -d 2017-02-18 -m 5
CVE-2017-6074 9.3 http://www.cvedetails.com/cve/CVE-2017-6074/
CVE-2017-6001 7.6 http://www.cvedetails.com/cve/CVE-2017-6001/
CVE-2017-5986 7.1 http://www.cvedetails.com/cve/CVE-2017-5986/
Telegram alert sent

Check your Telegram messages:

Autorun

You can add script to you monitoring system (Nagios/Icinga2, Zabbix, etc) or cron.

Example for cron:

$ crontab -e
* */12 * * * /path/to/vulncontrol.py -t 111111111:ABCDE 123456789 -m 5

Exit codes

Customizing output

You can customize result with more keys. Available keys:

• cve_id
• cvss_score
• cwe_id
• exploit_count
• publish_date
• summary
• update_date
• url

Example of JSON-output:

{
    "cve_id": "CVE-2017-5551",
    "cvss_score": "3.6",
    "cwe_id": "264",
    "exploit_count": "0",
    "publish_date": "2017-02-06",
    "summary": "The simple_set_acl function in fs/posix_acl.c in the Linux kernel before 4.9.6 preserves the setgid bit during a setxattr call involving a tmpfs filesystem, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7097.",
    "update_date": "2017-02-09",
    "url": "http://www.cvedetails.com/cve/CVE-2017-5551/"
}

www.cvedetails.com API

curl "https://www.cvedetails.com/json-feed.php?key1=value1&key2=value2..."

Custom parameters:

Boolean parameters (0 by default, 1 - yes):