secureCodeBox · J12934 · Apr 18, 2023 · Mar 21, 2023 · Mar 22, 2023 · Mar 22, 2023
diff --git a/parser-sdk/nodejs/findings-schema.json b/parser-sdk/nodejs/findings-schema.json
@@ -53,6 +53,22 @@
           "type": "string",
           "nullable": true
         },
+        "references": {
+          "nullable": true,
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "type": {
+                "type": "string"
+              },
+              "value": {
+                "type": "string"
+              }
+            },
+            "required": ["type", "value"]
+          }
+        },
         "attributes": {
           "description": "Attributes are not standardized. They differ from Scanner to Scanner.",
           "type": "object"

diff --git a/scanners/cmseek/parser/__snapshots__/parser.test.js.snap b/scanners/cmseek/parser/__snapshots__/parser.test.js.snap
@@ -18,6 +18,28 @@ exports[`parser parses result of Joomla scan with core vulnerabilities successfu
     "location": "http://172.26.0.3/",
     "name": "PHPMailer Remote Code Execution Vulnerability",
     "osi_layer": "APPLICATION",
+    "references": [
+      {
+        "type": "URL",
+        "value": "https://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection",
+      },
+      {
+        "type": "URL",
+        "value": "https://github.com/opsxcq/exploit-CVE-2016-10033",
+      },
+      {
+        "type": "URL",
+        "value": "https://www.exploit-db.com/exploits/40969/",
+      },
+      {
+        "type": "CVE",
+        "value": "CVE-2016-10033",
+      },
+      {
+        "type": "URL",
+        "value": "https://www.cve.org/CVERecord?id=CVE-2016-10033",
+      },
+    ],
     "severity": "HIGH",
   },
   {
@@ -35,6 +57,64 @@ exports[`parser parses result of Joomla scan with core vulnerabilities successfu
     "location": "http://172.26.0.3/",
     "name": "PPHPMailer Incomplete Fix Remote Code Execution Vulnerability",
     "osi_layer": "APPLICATION",
+    "references": [
+      {
+        "type": "URL",
+        "value": "https://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection",
+      },
+      {
+        "type": "URL",
+        "value": "https://www.exploit-db.com/exploits/40969/",
+      },
+      {
+        "type": "CVE",
+        "value": "CVE-2016-10045",
+      },
+      {
+        "type": "URL",
+        "value": "https://www.cve.org/CVERecord?id=CVE-2016-10045",
+      },
+    ],
+    "severity": "HIGH",
+  },
+  {
+    "attributes": {
+      "joomla_version": "3.6.5",
+      "references": [
+        "https://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection",
+        "EDB : https://www.exploit-db.com/exploits/40969/",
+      ],
+    },
+    "category": "Vulnerability",
+    "description": "Vulnerability of type PPHPMailer Incomplete Fix Remote Code Execution Vulnerability **without CVE** found",
+    "identified_at": "2021-09-22T10:29:01.721Z",
+    "location": "http://172.26.0.3/",
+    "name": "PPHPMailer Incomplete Fix Remote Code Execution Vulnerability **without CVE**",
+    "osi_layer": "APPLICATION",
+    "references": [
+      {
+        "type": "URL",
+        "value": "https://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection",
+      },
+      {
+        "type": "URL",
+        "value": "https://www.exploit-db.com/exploits/40969/",
+      },
+    ],
+    "severity": "HIGH",
+  },
+  {
+    "attributes": {
+      "joomla_version": "3.6.5",
+      "references": [],
+    },
+    "category": "Vulnerability",
+    "description": "Vulnerability of type PPHPMailer Incomplete Fix Remote Code Execution Vulnerability **without references** found",
+    "identified_at": "2021-09-22T10:29:01.721Z",
+    "location": "http://172.26.0.3/",
+    "name": "PPHPMailer Incomplete Fix Remote Code Execution Vulnerability **without references**",
+    "osi_layer": "APPLICATION",
+    "references": null,
     "severity": "HIGH",
   },
   {

diff --git a/scanners/cmseek/parser/__testFiles__/joomla_with_core_vulns.json b/scanners/cmseek/parser/__testFiles__/joomla_with_core_vulns.json
@@ -37,7 +37,20 @@
                 "https://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection",
                 "EDB : https://www.exploit-db.com/exploits/40969/"
             ]
+        },
+        {
+            "name": "PPHPMailer Incomplete Fix Remote Code Execution Vulnerability **without CVE**",
+            "references": [
+                "https://www.rapid7.com/db/modules/exploit/multi/http/phpmailer_arg_injection",
+                "EDB : https://www.exploit-db.com/exploits/40969/"
+            ]
+        },
+        {
+            "name": "PPHPMailer Incomplete Fix Remote Code Execution Vulnerability **without references**",
+            "references": [
+            ]
         }
+
     ],
-    "vulnerabilities_count": "2"
+    "vulnerabilities_count": "4"
 }
diff --git a/scanners/cmseek/parser/parser.js b/scanners/cmseek/parser/parser.js
@@ -49,7 +49,30 @@ async function parse(findings) {
   // Check if any core vulnerabilities exist; if yes list findings
   let parsed_vulnerabilities = []
   if (findings.vulnerabilities_count > 0) {
-    parsed_vulnerabilities = findings.vulnerabilities.map((vuln) => {
+    parsed_vulnerabilities = findings.vulnerabilities.map(vuln => {
+      // Fetch CVE from vulnerability references
+      const cve = fetchCVE(vuln.references);
+      const separator = " : ";
+
+      // Create CVE reference object if CVE exists
+      const cve_reference = cve ? [
+        { type: "CVE", value: cve },
+        { type: "URL", value: `https://www.cve.org/CVERecord?id=${cve}` }
+      ] : []; // Empty array if no CVE exists
+
+      // Create URL reference objects from the vulnerability references
+      const urls_references = vuln.references
+        .filter(ref => ref.includes("http"))
+        .map(ref => ({
+          type: "URL",
+          // Extract the URL if the reference includes the separator, otherwise use the whole reference
+          value: ref.includes(separator) ? ref.split(separator)[1].trim() : ref
+        }));
+
+      // Combine URL and CVE references, and filter out any empty reference
+      const references = [...urls_references, ...cve_reference].filter(r => r);
+
+      // Return the parsed vulnerability object
       return {
         name: vuln.name,
         identified_at: last_scanned,
@@ -58,14 +81,27 @@ async function parse(findings) {
         location: findings.url,
         osi_layer: "APPLICATION",
         severity: "HIGH",
+        references: references.length > 0 ? references : null,
         attributes: {
           joomla_version: findings.joomla_version,
-          references: vuln.references,
+          references: vuln.references
         }
       };
     });
-  }
+  }   
   // concat all parsed results
   return parsed_vulnerabilities.concat(parsed_backupFiles).concat(parsed_debug_mode_enabled)
 }
+// Helper function to fetch CVE from references
+// it is assumed that the reference is in the format "CVE : CVE-XXXX-XXXX"
+function fetchCVE(references) {
+  for (const reference of references) {
+    if (reference.includes("CVE :")) {
+      const cve = reference.split("CVE : ")[1].trim();
+      return cve;
+    }
+  }
+  return null;
+}
+
 module.exports.parse = parse;