Check Product Version Vulnerability

TL;DR

Automatically check if a product version is vulnerable using vulnerability databases and scripting tools. This guide covers finding data sources, writing scripts to query them, and integrating the process into your workflow.

1. Identify Vulnerability Databases

Several databases track known vulnerabilities. Here are some key options:

• National Vulnerability Database (NVD): https://nvd.nist.gov/ – Comprehensive, US government-maintained.
• CVE Details: https://www.cvedetails.com/ – Easy to search and often includes vendor information.
• VulDB: https://vuldb.com/ – Commercial database with a focus on timely updates.
• Vendor-Specific Databases: Many vendors (e.g., Microsoft, Adobe) maintain their own vulnerability databases. Check their security websites.

Choose the database(s) that best cover your products.

2. Accessing Vulnerability Data

You can access data in several ways:

• Web Interface: Manually search the database website. Good for one-off checks but not automated.
• API: Most databases offer an API (Application Programming Interface) allowing programmatic access. This is ideal for automation.
• Data Feeds: Some databases provide data feeds (e.g., JSON, XML) that you can download and parse.

APIs are the most flexible option. For example, NVD has an API:

curl -s "https://services.nvd.nist.gov/rest/json/cve1.0?keyword=Apache+Struts+2&resultsPerPage=5"

3. Scripting the Vulnerability Check

Write a script (e.g., Python, Bash, PowerShell) to query the database API with the product version you want to check.

Python Example

import requests
import json

def check_vulnerability(product, version):
    url = f"https://services.nvd.nist.gov/rest/json/cve1.0?keyword={product}+{version}&resultsPerPage=5"
    response = requests.get(url)
    data = response.json()

    if data['totalResults'] > 0:
        for cve in data['vulnerabilities']:
            print(f"CVE ID: {cve['cve']['id']}")
            print(f"Description: {cve['cve']['description']['description_data'][0]['value']}")
    else:
        print("No vulnerabilities found for this version.")

if __name__ == "__main__":
    product = input("Enter product name: ")
    version = input("Enter product version: ")
    check_vulnerability(product, version)

This script queries the NVD API and prints any matching CVEs (Common Vulnerabilities and Exposures). Adapt it to your chosen database’s API format.

4. Parsing the Results

The API will return data in a structured format (usually JSON or XML). Parse this data to extract relevant information:

• CVE ID: The unique identifier for the vulnerability.
• Severity Score: A numerical score indicating the severity of the vulnerability (e.g., CVSS score).
• Description: A detailed explanation of the vulnerability.
• Affected Versions: The product versions affected by the vulnerability.

Use your scripting language’s parsing libraries to extract this information.

5. Integrating into Your Workflow

Automate the process:

• Scheduled Scans: Run the script periodically (e.g., daily, weekly) to check for new vulnerabilities in your products. Use a task scheduler like cron (Linux/macOS) or Task Scheduler (Windows).
• CI/CD Pipeline Integration: Integrate the script into your Continuous Integration/Continuous Delivery pipeline to automatically check for vulnerabilities when new versions are built.
• Asset Management Systems: Incorporate vulnerability checks into your asset management system to track the security status of your products.

Consider using a dedicated vulnerability scanner if you need more advanced features (e.g., automated patching, reporting).

6. Handling False Positives

Vulnerability databases aren’t always perfect. You may encounter false positives (vulnerabilities reported for versions that are not actually affected).

• Verify with Vendor Information: Always confirm vulnerabilities with the vendor’s official security advisories.
• Test in a Safe Environment: Test potential exploits in a controlled environment to verify if the vulnerability is exploitable.