diff --git a/REQUIREMENTS b/REQUIREMENTS index c004afe..6ab46cc 100644 --- a/REQUIREMENTS +++ b/REQUIREMENTS @@ -25,3 +25,4 @@ yara sigmatools stix2-patterns maclookup +vulners \ No newline at end of file diff --git a/misp_modules/modules/expansion/vulners.py b/misp_modules/modules/expansion/vulners.py new file mode 100644 index 0000000..70b5d12 --- /dev/null +++ b/misp_modules/modules/expansion/vulners.py @@ -0,0 +1,39 @@ +import json +import requests +import vulners + +misperrors = {'error': 'Error'} +mispattributes = {'input': ['vulnerability'], 'output': ['text']} +moduleinfo = {'version': '0.1', 'author': 'Igor Ivanov', 'description': 'An expansion hover module to expand information about CVE id using Vulners API.', 'module-type': ['hover']} + +# Get API key from https://vulners.com/userinfo +moduleconfig = ["apikey"] + + +def handler(q=False): + if q is False: + return False + request = json.loads(q) + if not request.get('vulnerability'): + misperrors['error'] = 'Vulnerability id missing' + return misperrors + + key = q["config"]["apikey"] + vulners_api = vulners.Vulners(api_key=key) + vulners_document = vulners_api.document("CVE-2017-14174") + if vulners_document: + summary = vulners_document.get('description') + else: + summary = 'Non existing CVE' + + r = {'results': [{'types': mispattributes['output'], 'values': summary}]} + return r + + +def introspection(): + return mispattributes + + +def version(): + moduleinfo['config'] = moduleconfig + return moduleinfo