Skip to content

Commit eafc2b0

Browse files
ottocosterottocoster
authored
Add more CVEasy examples (#124)
* Remove CVE folder * Add CVEasy example * Other example * Linter * Aruba * Lint * More vendors * Fix linter errors * Fix linter issues * Fix linter issues * Indent * Indent (2)
1 parent 285429f commit eafc2b0

File tree

4 files changed

+219
-0
lines changed

4 files changed

+219
-0
lines changed

‎CVEasy/Aruba/2024/cve20241356.py

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve20241356',
6+
platform=['aruba_os'],
7+
commands=dict(
8+
show_version='show version',
9+
show_cli_config='show cli-config'
10+
),
11+
)
12+
def rule_cve20241356(configuration, commands, device, devices):
13+
"""
14+
This rule checks for CVE-2024-1356 vulnerability in ArubaOS Wi-Fi Controllers and Campus/Remote Access Points.
15+
The vulnerability allows authenticated users to execute arbitrary commands as a privileged user through
16+
command injection vulnerabilities in the CLI interface.
17+
"""
18+
# Extract the version information from the command output
19+
version_output = commands.show_version
20+
21+
# Define the vulnerable versions
22+
vulnerable_versions = [
23+
# ArubaOS 10.5.x.x versions
24+
'10.5.0.0', '10.5.0.1',
25+
# ArubaOS 10.4.x.x versions
26+
'10.4.0.0', '10.4.0.1', '10.4.0.2', '10.4.0.3',
27+
# ArubaOS 8.11.x.x versions
28+
'8.11.0.0', '8.11.1.0', '8.11.2.0',
29+
# ArubaOS 8.10.x.x versions
30+
'8.10.0.0', '8.10.0.1', '8.10.0.2', '8.10.0.3', '8.10.0.4',
31+
'8.10.0.5', '8.10.0.6', '8.10.0.7', '8.10.0.8', '8.10.0.9'
32+
]
33+
34+
# Check if the current version is vulnerable
35+
version_vulnerable = any(version in version_output for version in vulnerable_versions)
36+
37+
# If version is not vulnerable, exit early
38+
if not version_vulnerable:
39+
return
40+
41+
# Check if CLI access is enabled
42+
cli_config = commands.show_cli_config
43+
cli_enabled = 'cli-config enabled' in cli_config
44+
45+
# Assert that the device is not vulnerable
46+
assert not cli_enabled, (
47+
f"Device {device.name} is vulnerable to CVE-2024-1356. "
48+
"The device is running a vulnerable version with CLI access enabled, "
49+
"which makes it susceptible to authenticated command injection attacks. "
50+
"For more information, see https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2024-002.txt"
51+
)

‎CVEasy/Cisco/2024/cve202420276.py

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202420276',
6+
platform=['cisco_ios'],
7+
commands=dict(
8+
show_version='show version',
9+
show_running_config='show running-config | include interface|port-security|device classifier|'
10+
'system-auth-control|port-control|mab'
11+
),
12+
)
13+
def rule_cve202420276(configuration, commands, device, devices):
14+
"""
15+
This rule checks for the presence of CVE-2024-20276 vulnerability in Cisco Catalyst 6000 Series Switches.
16+
The vulnerability is due to improper handling of process-switched traffic, which can be exploited by an
17+
unauthenticated, adjacent attacker to cause a denial of service (DoS) condition by reloading the device.
18+
"""
19+
# Extract the version information from the command output
20+
version_output = commands.show_version
21+
22+
# List of vulnerable software versions
23+
vulnerable_versions = [
24+
# 15.5(1)SY versions
25+
'15.5(1)SY5', '15.5(1)SY6', '15.5(1)SY7', '15.5(1)SY8',
26+
'15.5(1)SY9', '15.5(1)SY10', '15.5(1)SY11'
27+
]
28+
29+
# Check if the current device's software version is in the list of vulnerable versions
30+
version_vulnerable = any(version in version_output for version in vulnerable_versions)
31+
32+
# If version is not vulnerable, no need to check further
33+
if not version_vulnerable:
34+
return
35+
36+
# If version is vulnerable, check for enabled features
37+
config_output = commands.show_running_config
38+
39+
# Check if port security is enabled
40+
port_security_enabled = 'switchport port-security' in config_output
41+
42+
# Check if device classifier is enabled
43+
device_classifier_enabled = 'device classifier' in config_output
44+
45+
# Check if AAA is enabled
46+
aaa_enabled = any(keyword in config_output for keyword in [
47+
'dot1x system-auth-control',
48+
'authentication order',
49+
'authentication priority',
50+
'authentication port-control',
51+
'mab'
52+
])
53+
54+
# If any of the above features are enabled, the device is vulnerable
55+
is_vulnerable = port_security_enabled or device_classifier_enabled or aaa_enabled
56+
57+
# Assert that the device is not vulnerable
58+
# If the device is vulnerable, the test will fail, indicating the presence of the vulnerability
59+
assert not is_vulnerable, (
60+
f"Device {device.name} is vulnerable to CVE-2024-20276. "
61+
"The device is running a vulnerable version AND has port security, device classifier, or AAA enabled, "
62+
"which makes it susceptible to DoS attacks. "
63+
"For more information, see "
64+
"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ios-dos-Hq4d3tZG"
65+
)

‎CVEasy/Fortinet/2024/cve202423110.py

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve202423110',
6+
platform=['fortinet'],
7+
commands=dict(
8+
show_version='get system status'
9+
),
10+
)
11+
def rule_cve202423110(configuration, commands, device, devices):
12+
"""
13+
This rule checks for the CVE-2024-23110 vulnerability in Fortinet FortiOS.
14+
The vulnerability is a stack-based buffer overflow that allows an attacker to execute
15+
unauthorized code or commands via specially crafted commands.
16+
"""
17+
# Extract the version information from the command output
18+
version_output = commands.show_version
19+
20+
# List of vulnerable software versions
21+
vulnerable_versions = [
22+
'7.4.0', '7.4.1', '7.4.2',
23+
'7.2.0', '7.2.1', '7.2.2', '7.2.3', '7.2.4', '7.2.5', '7.2.6',
24+
'7.0.0', '7.0.1', '7.0.2', '7.0.3', '7.0.4', '7.0.5', '7.0.6', '7.0.7', '7.0.8', '7.0.9', '7.0.10',
25+
'7.0.11', '7.0.12', '7.0.13',
26+
'6.4.0', '6.4.1', '6.4.2', '6.4.3', '6.4.4', '6.4.5', '6.4.6', '6.4.7', '6.4.8', '6.4.9', '6.4.10',
27+
'6.4.11', '6.4.12', '6.4.13', '6.4.14',
28+
'6.2.0', '6.2.1', '6.2.2', '6.2.3', '6.2.4', '6.2.5', '6.2.6', '6.2.7', '6.2.8', '6.2.9', '6.2.10',
29+
'6.2.11', '6.2.12', '6.2.13', '6.2.14', '6.2.15',
30+
'6.0.0', '6.0.1', '6.0.2', '6.0.3', '6.0.4', '6.0.5', '6.0.6', '6.0.7', '6.0.8', '6.0.9', '6.0.10',
31+
'6.0.11', '6.0.12', '6.0.13', '6.0.14', '6.0.15', '6.0.16', '6.0.17', '6.0.18'
32+
]
33+
34+
# Check if the current device's software version is in the list of vulnerable versions
35+
version_vulnerable = any(version in version_output for version in vulnerable_versions)
36+
37+
# Assert that the device is not vulnerable
38+
assert not version_vulnerable, (
39+
f"Device {device.name} is vulnerable to CVE-2024-23110. "
40+
"The device is running a vulnerable version, which makes it susceptible to stack-based buffer"
41+
"overflow attacks. For more information, see "
42+
"https://fortiguard.com/psirt/FG-IR-23-460"
43+
)

‎CVEasy/Juniper/2024/cve20242973.py

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
from comfy import high
2+
3+
4+
@high(
5+
name='rule_cve20242973',
6+
platform=['juniper_junos'],
7+
commands=dict(
8+
show_version='show version',
9+
show_config_ha='show configuration | display set | match "high-availability"'
10+
)
11+
)
12+
def rule_cve20242973(configuration, commands, device, devices):
13+
"""
14+
This rule checks for CVE-2024-2973 vulnerability in Juniper Networks Session Smart Router (SSR),
15+
Session Smart Conductor, and WAN Assurance Router. The vulnerability allows an unauthenticated,
16+
network-based attacker to bypass authentication and take full control of devices in redundant
17+
router deployments.
18+
19+
Args:
20+
configuration (str): The full device configuration
21+
commands (dict): Output of the executed commands
22+
device: The current device object
23+
devices: All devices in the test scope
24+
"""
25+
# Extract version information
26+
version_output = commands.show_version
27+
28+
# List of vulnerable software versions
29+
vulnerable_versions = [
30+
# SSR versions before 5.6.15
31+
'5.6.14', '5.6.13', '5.6.12', '5.6.11', '5.6.10',
32+
'5.6.9', '5.6.8', '5.6.7', '5.6.6', '5.6.5',
33+
'5.6.4', '5.6.3', '5.6.2', '5.6.1', '5.6.0',
34+
# 6.0 versions before 6.1.9-lts
35+
'6.0.0', '6.0.1', '6.0.2', '6.0.3', '6.0.4',
36+
'6.1.0', '6.1.1', '6.1.2', '6.1.3', '6.1.4',
37+
'6.1.5', '6.1.6', '6.1.7', '6.1.8',
38+
# 6.2 versions before 6.2.5-sts
39+
'6.2.0', '6.2.1', '6.2.2', '6.2.3', '6.2.4'
40+
]
41+
42+
# Check if version is vulnerable
43+
version_vulnerable = any(version in version_output for version in vulnerable_versions)
44+
45+
if not version_vulnerable:
46+
return
47+
48+
# Check if high-availability is configured
49+
ha_config = commands.show_config_ha
50+
ha_enabled = 'high-availability' in ha_config
51+
52+
assert not ha_enabled, (
53+
f"Device {device.name} is vulnerable to CVE-2024-2973. "
54+
"The device is running a vulnerable version with high-availability configured. "
55+
"This configuration can allow an attacker to bypass authentication and take full control. "
56+
"Please upgrade to one of the following fixed versions: "
57+
"SSR-5.6.15, SSR-6.1.9-lts, SSR-6.2.5-sts, or later. "
58+
"For Conductor-managed deployments, upgrading Conductor nodes is sufficient. "
59+
"For more information, see https://supportportal.juniper.net/JSA83126"
60+
)

0 commit comments

Comments
 (0)