BUG: Can not import Wazuh Vulnerability Files

[CyberAbwehr]

Bug description

Can not import Wazuh Vulnerability Files

DefectDojo v.2.30.3

Wazuh v4.7.2

ERROR

An exception error occurred during the report import:['Extra data: line 1 column 6 (char 5)']
Well...
...this was unexpected.
500 Internal Server Error

Wazuh v4.7.3

ERROR

An exception error occurred during the report import:['Extra data: line 1 column 22 (char 21)']
Well...
...this was unexpected.
500 Internal Server Error

Steps to reproduce
see attched sample files

Expected behavior
I can import Wazuh Vulnerability Files

Deployment method

• Docker Compose

Environment information

• Operating System: Ubuntu 22.04.3 LTS
• DefectDojo version v.2.30.3

Sample scan files

vulnerabilities_wazuh_v472.csv

vulnerabilities_wazuh_v473.csv

[manuel-sommer]

Hi @CyberAbwehr ,

only JSON output is supported. This is not a bug, but rather a feature request. Could you try to export JSON content over the API and import it in DefectDojo?
https://defectdojo.github.io/django-DefectDojo/integrations/parsers/file/wazuh/

[CyberAbwehr]

Hi @manuel-sommer

Wazuh v472 JSON is not working

wazuh_vul_472.json

Wazuh v473 JSON is working

wazuh_vul_473.json

[manuel-sommer]

Hi @CyberAbwehr ,

no, the behavior is as expected.
See here:

django-DefectDojo/dojo/tools/wazuh/parser.py

Line 34 in 1f450c2

item["condition"] != "Package unfixed"

If a finding has : item["condition"] != "Package unfixed" and item["severity"] != "Untriaged" then the finding is added. All of your findings in the first file either have Package unfixed or severity is untriaged.

[manuel-sommer]

Please close this issue.

[manuel-sommer]

This behavior can be finetune once #9250 is implemented.

[CyberAbwehr]

Closed

[CyberAbwehr]

Ups Sorry,

But in the file i have open vulnerabilities.

wazuh_vul_472.json

   "cve": "CVE-2022-28391",
    "published": "2022-04-03",
    "cvss2_score": 6.8,
    "version": "1:1.35.0-4",
    "architecture": "amd64",
    "status": "VALID",
    "detection_time": "2024-03-13T09:01:06+00:00",
    "severity": "High",
    "title": "CVE-2022-28391 affects busybox",
    "name": "busybox",
    "updated": "2022-08-11",
    "type": "PACKAGE",
    "external_references": [
      "https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch",
      "https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch",
      "https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661",
      "https://nvd.nist.gov/vuln/detail/CVE-2022-28391",
      "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28391"
    ],
    "condition": "Package unfixed",
    "cvss3_score": 8.8

[manuel-sommer]

"condition": "Package unfixed",

[manuel-sommer]

Please close the issue or finetune the scanner yourself. ;-)

[manuel-sommer]

@CyberAbwehr, this is the only known issue: #9728

[CyberAbwehr]

This is the meaning correct?
The vulnerabilities with condition "Package unfixed" are skipped because there is no fix out yet.

This is important information in the vulnerability management process.
You have to coordinate this with the asset owner.
He has to take the risk. (Risk acceptance)
In the worst case, this open vulnerability ends up in problem management.

[manuel-sommer]

Please open up a PR to fix this issue.

[CyberAbwehr]

Please can you help me to open a Pull Request.

[manuel-sommer]

Hi @CyberAbwehr , I know that some people use it this way and like it also this way. If I know open up a PR to fix it, the next month, another PR will be opened to change it back. You can either change it for your own deployment or wait until #9250 is implemented (I also would like to have this feature), then we can get this issue finetuned and everybody can use it as they would like to have it. Thus, I will not make a PR in this regards.