fix: Update NVD CPE search URLs to match new search interface

[chadlwilson]

Description of Change

NVD appear to have updated their search interface in a way that breaks our earlier generated deep links from reports etc.

The new interface is similar, but the URLs build CPE identifiers rather than individual components. The "applicability" mode appears to be correct (otherwise you get matches where a given vuln is running on/with a CPE but not affecting that CPE?)

Version-specific search
https://nvd.nist.gov/vuln/search#/nvd/home?sortOrder=3&sortDirection=2&cpeFilterMode=applicability&cpeName=cpe:2.3:a:vmware:spring_framework:5.0.0:*:*:*:*:*:*:*&resultType=records

Broad search
https://nvd.nist.gov/vuln/search#/nvd/home?sortOrder=3&sortDirection=2&cpeFilterMode=applicability&cpeName=cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*&resultType=records

Open questions

• should I add a default sort order? Order seems random/database order otherwise.
  • Sort by identifier? descending? ascending?
  • Published Date? Descending ✅
• Need to update URLs inside the HTML and Jenkins report templates?
  • These ones go to URLs like this - but they are totally broken/404ed so I am not sure if that recently happened or if they have been broken for a while.

Related issues

• fixes [Bug] >300k CVEs #7962

Have test cases been added to cover the new functionality?

yes

Example report generated via Gradle plugin locally:
dependency-check-report.html

[jeremylong]

1. We should add a sort order - published date is probably good enough, descending if possible (i.e., newest first).
2. If the links are broken in the HTML report, we likely need to fix them as well. The easiest approach would be to expose the nvdSearchUrlFor() methods in the ReportTool, as it is already added to the Velocity context.

[chadlwilson]

Thanks @jeremylong - I didn’t look at the 2nd one at all, it turned out a bit messier than i thought and I ran out of time. I couldn’t work out what the urls are used for in the CpeIdentifier object if not used later to actually render the report, so it needed more digging as to the reason for the 404ing URLs and which section of the report those ones appear in.

[jeremylong]

Understood, the HTML reports contain code like:

  <p>Vulnerable Software &amp; Versions:<ul>
      <li class="vs$vsctr"><a target="_blank" href="https://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cpe_version=$enc.url($vuln.matchedVulnerableSoftware.toCpe22Uri())">$enc.html($vuln.matchedVulnerableSoftware.toString())</a></li>
  </ul></p>

ReportTool.java

...
public String getNvdSearchURL(VulnerableSoftware vs) {
     return CpeIdentifier.nvdSearchUrlFor(vs.getVendor(), vs.getProduct(), vs.getVersion());
}
...

Then in the reports, something like:

  <p>Vulnerable Software &amp; Versions:<ul>
      <li class="vs$vsctr"><a target="_blank" href="$rpt.getNvdSearchURL($vuln.matchedVulnerableSoftware)">$enc.html($vuln.matchedVulnerableSoftware.toString())</a></li>
  </ul></p>

Some of the generated URLs look like the broad pattern and others the more specific one - so we may need two methods exposed.

[chadlwilson]

OK I figured out that a different mechanism was being used for the "Identifiers" vs. the "Vulnerable Software & Versions" sections. Which also had a different URL syntax. Not sure, but suspect the "Vulnerable Software & Versions" links might have been broken for a while.

I've made this change now, however needs a bit more testing.

I think we don't need to specifically use the broad URLs, because the search syntax just takes a CPE 2.3 formatted string anyway. If from the NVD match we know details such as the version number from the matched software (sometimes it is included, if the affected version is not a range), it should be fine to include it in the search. In most other cases including * should be sufficient.

This new search also allows us to search specficially for all the other pieces of the CPE that have shown up in the NVD match, not just part/vendor/product/version - so behaviour should be better, I think.

[chadlwilson]

Added an example HTML report generated with this to the description.