Merge branch 'tkt_367_fix_nessus_cvss' into 'dev'

Fix nessus plugin

See merge request faradaysec/faraday-plugins!278

Author: Diego Nadares

.gitignore

@@ -133,3 +133,6 @@ dmypy.json
 
 # extras for testing
 report-collection
+
+#vscode
+.vscode/

CHANGELOG/current/367.md

@@ -0,0 +1 @@
+[FIX] CVSS values in nessus plugin. #367

faraday_plugins/plugins/repo/nessus/plugin.py

@@ -9,6 +9,8 @@
 
 from dateutil.parser import parse
 from faraday_plugins.plugins.plugin import PluginXMLFormat
+from faraday_plugins.plugins.plugins_utils import CVE_regex
+from faraday_plugins.plugins.plugins_utils import get_severity_from_cvss
 
 __author__ = "Blas"
 __copyright__ = "Copyright (c) 2019, Infobyte LLC"
@@ -20,7 +22,6 @@
 __status__ = "Development"
 
 from faraday_plugins.plugins.repo.nessus.DTO import ReportHost, Report, ReportItem
-from faraday_plugins.plugins.plugins_utils import get_severity_from_cvss
 
 class NessusParser:
     """
@@ -183,21 +184,52 @@ def parseOutputString(self, output):
     def map_add_ref(main_data, item: ReportItem):
         main_data["cvss2"] = {}
         main_data["cvss3"] = {}
+        
+        found_cves = set()
+
+        if item.cve:
+            if isinstance(item.cve, str):
+                cves_in_item_cve_field = CVE_regex.findall(item.cve)
+                found_cves.update(cves_in_item_cve_field)
+            elif isinstance(item.cve, list):
+                for c_val in item.cve:
+                    if isinstance(c_val, str):
+                        found_cves.add(c_val)
+        
         if item.see_also:
             main_data["ref"].append(item.see_also)
+            # Extract CVEs from see_also string
+            cves_from_see_also = CVE_regex.findall(item.see_also)
+            found_cves.update(cves_from_see_also)
+
+        if found_cves:
+            main_data["cve"] = sorted(list(found_cves))
+        
         if item.cpe:
             main_data["ref"].append(item.cpe)
-        if item.cve:
-            main_data["cve"] = item.cve
         if item.cwe:
             main_data["cwe"] = item.cwe
+
         if item.cvss3_vector:
-            main_data["cvss3"]["vector_string"] = item.cvss3_vector
-        #if item has cvss3.base_score use it for severity
+            cvss3_vector_string = item.cvss3_vector
+            # Prepend "CVSS:3.0/" if no "CVSS:3.x" prefix exists, similar to Nessus SC plugin
+            if not cvss3_vector_string.startswith("CVSS:3."):
+                cvss3_vector_string = "CVSS:3.0/" + cvss3_vector_string
+            main_data["cvss3"]["vector_string"] = cvss3_vector_string
+        
         if item.cvss3_base_score:
+            main_data["cvss3"]["base_score"] = item.cvss3_base_score
             main_data["severity"] = get_severity_from_cvss(item.cvss3_base_score)
+        
         if item.cvss_vector:
             main_data["cvss2"]["vector_string"] = item.cvss_vector
+        
+        if item.cvss2_base_score:
+            main_data["cvss2"]["base_score"] = item.cvss2_base_score
+            # If CVSSv3 score is not present, use CVSSv2 score for severity
+            if not item.cvss3_base_score:
+                main_data["severity"] = get_severity_from_cvss(item.cvss2_base_score)
+        
         return main_data