nvd_cve

🔎 在本地缓存的 NIST 国家漏洞数据库（NVD）副本中搜索 CVE。

nvd_cve 是一个用于同步和搜索 NIST 国家漏洞数据库的命令行工具和 Rust 模块。它的功能旨在为利用 CVE 数据的漏洞管理任务和自动化工作提供便利。在 NIST NVD 网站或 API 无法访问的情况下，本地缓存也可能很有用。

用法

命令行用法

nvd_cve 命令行应用程序提供了 sync 和 search 命令。

Search for CVEs against a local cached copy of NIST National Vulnerability Database (NVD).

USAGE:
    nvd_cve [SUBCOMMAND]

FLAGS:
    -h, --help       Prints help information
    -V, --version    Prints version information

SUBCOMMANDS:
    help      Prints this message or the help of the given subcommand(s)
    search    Search for a CVE by ID in the local cache
    sync      Sync CVE feeds to local database

🔃 同步

在您搜索 CVE 之前，您应该执行 sync 命令，这将拉取数据源并在 SQLite 中构建本地缓存。

Sync CVE feeds to local database

USAGE:
    nvd_cve sync [FLAGS] [OPTIONS]

FLAGS:
    -f, --force           Ignore existing Metafiles and force update all feeds
    -h, --help            Prints help information
    -n, --no-progress     Don't show progress bar when syncing feeds
    -s, --show-default    Show default config values and exit
    -V, --version         Prints version information
    -v, --verbose         Print verbose logs (Set level with RUST_LOG)

OPTIONS:
    -d, --db <FILE>       Path to SQLite database where CVE feed data will be stored
    -l, --feeds <LIST>    Comma separated list of CVE feeds to fetch and sync, defaults to: all known feeds
    -u, --url <URL>       URL to use for fetching feeds, defaults to: https://nvd.nist.gov/feeds/json/cve/1.1

示例

初始数据库构建需要几分钟，但后续运行将快得多，因为只有已修改的源将被检索和更新。

$ ./nvd_cve sync
[Feed: 2012] Fetching feed (1.97 MB)              [================------------------------]  42%

如果官方 NIST 源不可用或响应缓慢，您可以使用 镜像

$ ./target/debug/nvd_cve sync -u https://www.harmless.systems/mirror/nvd/feeds/json/cve/1.1/    
[Feed: 2015] Fetching feed (2.10 MB)              [=======================-----------------]  59%

🔎 搜索

通过特定的 CVE 或描述中的某些文本进行搜索。

Search for a CVE by ID in the local cache

USAGE:
    nvd_cve search [FLAGS] [OPTIONS] [CVE]

FLAGS:
    -h, --help       Prints help information
    -V, --version    Prints version information
    -v, --verbose    Print verbose logs (Set level with RUST_LOG)

OPTIONS:
    -d, --db <FILE>        Path to SQLite database where CVE feed data will be stored
    -t, --text <STRING>    Search the CVE descriptions instead.

ARGS:
    <CVE>    CVE ID to retrieve

示例

按 CVE ID 搜索

$ nvd_cve search CVE-2019-12780
{
  "data_type": "CVE",
  "data_format": "MITRE",
  "data_version": "4.0",
  "cve_data_meta": {
    "id": "CVE-2019-12780",
    "assigner": "[email protected]"
  },
  "problem_type": {
    "problem_type_data": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-78"
          }
        ]
      }
    ]
  },
  "references": {
    "reference_data": [
      {
        "url": "https://www.exploit-db.com/exploits/46436",
        "name": "https://www.exploit-db.com/exploits/46436",
        "ref_source": "MISC",
        "tags": [
          "Exploit",
          "Third Party Advisory",
          "VDB Entry"
        ]
      }
    ]
  },
  "description": {
    "description_data": [
      {
        "lang": "en",
        "value": "The Belkin Wemo Enabled Crock-Pot allows command injection in the Wemo UPnP API via the SmartDevURL argument to the SetSmartDevInfo action. A simple POST request to /upnp/control/basicevent1 can allow an attacker to execute commands without authentication."
      }
    ]
  }
}

在 CVE 描述中搜索

$ nvd_cve search -t Crock-Pot
CVE-2019-12780

模块用法

有关如何程序化使用 crate 的示例，请参阅 示例目录。