feat(cve): add 100 additional Windows/AD CVEs - #35
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2811d1c73b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| @@ -1 +1,10 @@ | |||
| __version__ = "1.1.3" | |||
| __version__ = "1.1.4" | |||
There was a problem hiding this comment.
When the release workflow runs python -m build, the artifact version comes from pyproject.toml, which remains 1.1.3; the repository's custom publisher also explicitly reads that file. Consequently this change reports adpentest.__version__ == "1.1.4" while producing a 1.1.3 distribution, preventing consumers from installing 1.1.4 and potentially causing PyPI to reject the already-published version. Update the project metadata together with this runtime version.
Useful? React with 👍 / 👎.
| {"cve_id": "CVE-2022-24522", "component": "Windows/SMB", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, | ||
| {"cve_id": "CVE-2022-26837", "component": "Windows remote services / RPC", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, | ||
| {"cve_id": "CVE-2022-26937", "component": "Windows", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, | ||
| {"cve_id": "CVE-2022-27518", "component": "Windows", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, |
There was a problem hiding this comment.
For consumers selecting findings for Windows or AD hosts, this entry incorrectly presents CVE-2022-27518 as a Windows vulnerability, and merge_with_registry() further assigns it the windows tag. CVE-2022-27518 affects Citrix ADC/Gateway, so this metadata produces irrelevant vulnerability candidates unless the target independently runs the affected Citrix appliance.
Useful? React with 👍 / 👎.
| {"cve_id": "CVE-2023-21716", "component": "Exchange Server", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, | ||
| {"cve_id": "CVE-2023-23397", "component": "Exchange Server", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, |
There was a problem hiding this comment.
When callers filter the catalog by component or correlate an Exchange Server version, these entries falsely identify CVE-2023-21716 and CVE-2023-23397 as Exchange Server vulnerabilities. They affect Microsoft Word and Microsoft Outlook respectively, so Exchange-only targets can be incorrectly included while the actual vulnerable client products are obscured.
Useful? React with 👍 / 👎.
Consolidates all package modules (core, cve_catalog_100, cve_catalog_de_novo_40, de_novo, __init__) into one importable .py file preserving the full public API and version 1.1.5. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01StfRVksGuSEQdzZAoXUNpC
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01StfRVksGuSEQdzZAoXUNpC
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b8b874752e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| print(f"[VERBOSE] [detect_exchange_ews] EWS check failed for {ews_url}: {e}", file=sys.stderr, flush=True) | ||
|
|
||
| return False, None | ||
| except Im |
There was a problem hiding this comment.
When adpentest_onefile.py is used as the standalone distribution, the child commands for the CVE scanners still execute from adpentest.core import .... On a machine that has only this file, adpentest is not installed, so these subprocesses fail with ModuleNotFoundError instead of invoking the functions copied into the single-file module; the same hard-coded import affects the Windows, SPN, and email Python tools in this command builder.
Useful? React with 👍 / 👎.
| """ | ||
| executable = binary or shutil.which("de_novo_finder") | ||
| if not executable: | ||
| local = Path(__file__).resolve().parent.parent / "native" / "de_novo_finder" |
There was a problem hiding this comment.
For a standalone file at /path/adpentest_onefile.py, this expression checks /native/de_novo_finder, while the documented build command creates /path/native/de_novo_finder. Consequently find_de_novo() reports the engine as unavailable when users compile it alongside the downloaded single-file distribution unless they also modify PATH.
Useful? React with 👍 / 👎.
| [executable, target, str(timeout_ms)], | ||
| capture_output=True, | ||
| text=True, | ||
| timeout=max(5, timeout_ms / 1000 * 12), |
There was a problem hiding this comment.
When a target name resolves to two or more addresses and the probed ports are filtered, the native engine can spend timeout_ms on every address for each of its ten services, but this wrapper allows only twelve probe intervals total. A normal dual-address target can therefore exceed the default 9.6-second subprocess limit, raising an uncaught TimeoutExpired instead of returning the promised structured findings.
Useful? React with 👍 / 👎.
| print(f"[VERBOSE] [detect_exchange_ews] EWS check failed for {ews_url}: {e}", file=sys.stderr, flush=True) | ||
|
|
||
| return False, None | ||
| except Im |
There was a problem hiding this comment.
__all__
This second assignment replaces the catalog-oriented __all__ declared near the top of the single-file module. As a result, from adpentest_onefile import * omits EXTENDED_CVES, the de-novo catalog APIs, and find_de_novo, so the new distribution does not preserve those public APIs for wildcard-import consumers.
Useful? React with 👍 / 👎.
| @@ -0,0 +1,11489 @@ | |||
| """adpentest - single-file distribution. | |||
There was a problem hiding this comment.
The inspected publish workflow only runs python -m build and publishes dist/*, but the current setuptools package discovery includes only adpentest*; both the generated wheel and sdist therefore omit this root-level module. Users installing or downloading the published Python distribution cannot obtain the newly advertised single-file distribution unless it is explicitly added to the build configuration or uploaded as a separate release artifact.
Useful? React with 👍 / 👎.
| int exposed[sizeof(services) / sizeof(services[0])] = {0}; | ||
| size_t count = sizeof(services) / sizeof(services[0]); | ||
|
|
||
| printf("{\n \"target\":\"%s\",\n \"engine\":\"de-novo-c\",\n \"read_only\":true,\n \"findings\":[\n", host); |
There was a problem hiding this comment.
When the supplied target contains a JSON-special character such as a quote, backslash, or newline, this interpolation writes it directly into the JSON document. The native executable then emits invalid JSON, and the Python wrapper raises JSONDecodeError at json.loads(proc.stdout) instead of returning structured findings; serialize or JSON-escape this user-provided value before printing it.
Useful? React with 👍 / 👎.
| {"cve_id": "CVE-2024-29996", "component": "Windows", "family": "Windows/AD ecosystem", "assessment": "metadata-only; validate affected Windows versions before correlation"}, | ||
| {"cve_id": "CVE-2024-29997", "component": "Windows", "family": "Windows/AD ecosystem", "assessment": "metadata-only; validate affected Windows versions before correlation"}, | ||
| {"cve_id": "CVE-2024-29998", "component": "Windows", "family": "Windows/AD ecosystem", "assessment": "metadata-only; validate affected Windows versions before correlation"}, | ||
| {"cve_id": "CVE-2024-38063", "component": "Windows TCP/IP", "family": "Windows/AD ecosystem", "assessment": "metadata-only; validate affected Windows versions and network-stack configuration"}, |
There was a problem hiding this comment.
When consumers combine the two catalogs exported together from adpentest, CVE-2024-38063 appears here and in EXTENDED_CVES, yielding 140 records but only 139 distinct CVEs. The two copies also provide different component and assessment metadata, so aggregation can double-report the vulnerability or produce order-dependent metadata; keep it in only one catalog or deduplicate through a shared merge API.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7319224f9b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| {"cve_id": "CVE-2020-1048", "component": "Windows remote services / RPC", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, | ||
| {"cve_id": "CVE-2020-1054", "component": "Windows", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, | ||
| {"cve_id": "CVE-2020-1337", "component": "Windows", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, | ||
| {"cve_id": "CVE-2020-1350", "component": "Windows authentication / privilege boundary", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, |
There was a problem hiding this comment.
When consumers select candidates by component, CVE-2020-1350 is incorrectly categorized as an authentication/privilege-boundary issue. This CVE is the Windows DNS Server remote-code-execution vulnerability known as SigRed, so the current metadata both hides it from DNS Server assessments and introduces it into unrelated authentication-focused results.
Useful? React with 👍 / 👎.
| {"cve_id": "CVE-2022-21920", "component": "Windows", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, | ||
| {"cve_id": "CVE-2022-22047", "component": "Windows", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, | ||
| {"cve_id": "CVE-2022-22040", "component": "Windows", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, | ||
| {"cve_id": "CVE-2022-24521", "component": "Windows/SMB", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, |
There was a problem hiding this comment.
When callers filter or correlate findings for SMB, this record falsely includes CVE-2022-24521 because its component contains SMB. The vulnerability affects the Windows Common Log File System driver rather than SMB, so SMB hosts can receive an irrelevant candidate while CLFS-focused assessments cannot identify the actual affected component.
Useful? React with 👍 / 👎.
| {"cve_id": "CVE-2023-36874", "component": "Windows", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, | ||
| {"cve_id": "CVE-2023-36884", "component": "Windows", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, | ||
| {"cve_id": "CVE-2023-38148", "component": "Windows", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, | ||
| {"cve_id": "CVE-2023-4863", "component": "Windows/networking ecosystem", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, |
There was a problem hiding this comment.
When this catalog is merged, CVE-2023-4863 receives the windows and ad-assessment tags even though it is a heap-buffer-overflow vulnerability in libwebp used by applications across multiple operating systems, not a Windows networking vulnerability. Windows/AD inventory correlation will therefore generate a candidate solely from the operating system rather than from evidence that an affected libwebp consumer is installed.
Useful? React with 👍 / 👎.
| except OSError: | ||
| continue |
There was a problem hiding this comment.
Whenever the Python fallback receives an unresolvable hostname, socket.create_connection raises socket.gaierror, but this broad OSError handler treats it exactly like a closed port for all ten probes. The function then returns status: completed with no findings, so a misspelled or DNS-inaccessible target is indistinguishable from a successfully assessed host with no exposed services; handle name-resolution failures as an error rather than continuing.
Useful? React with 👍 / 👎.
| {"cve_id": "CVE-2020-0610", "component": "Windows", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, | ||
| {"cve_id": "CVE-2020-0646", "component": "Windows authentication / privilege boundary", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, | ||
| {"cve_id": "CVE-2020-0665", "component": "Windows", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, | ||
| {"cve_id": "CVE-2020-0688", "component": "Windows", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, |
There was a problem hiding this comment.
When consumers filter the catalog for Exchange Server findings, this generic Windows component causes CVE-2020-0688 to be omitted even though it is a Microsoft Exchange Server remote-code-execution vulnerability involving its validation keys. The catalog already uses Exchange Server for other Exchange records, so this entry should identify the affected server product rather than the host operating system.
Useful? React with 👍 / 👎.
| {"cve_id": "CVE-2020-1015", "component": "Windows remote services / RPC", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, | ||
| {"cve_id": "CVE-2020-1017", "component": "Windows", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, | ||
| {"cve_id": "CVE-2020-1020", "component": "Windows", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, | ||
| {"cve_id": "CVE-2020-1048", "component": "Windows remote services / RPC", "family": "Windows/AD ecosystem", "assessment": "metadata-only; correlate product/version/configuration with NVD and vendor guidance"}, |
There was a problem hiding this comment.
When callers select candidates for Windows RPC services, this component incorrectly includes CVE-2020-1048. That CVE affects the Windows Print Spooler and is an elevation-of-privilege vulnerability, so the current label creates an irrelevant RPC candidate while preventing Print Spooler-specific correlation from finding it.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
AdPentestAI-Python/adpentest/core.py
Lines 9757 to 9760 in d53f963
Quote the detected domain before embedding it in Python
When a target-controlled LDAP RootDSE supplies a naming context whose DC= value contains a quote and Python syntax, detected_domain reaches domain_arg without validation and is interpolated directly into this python -c program. Selecting enum_windows_py—which careful mode does by default—then executes that injected syntax on the scanner host; pass the value through argv or embed it with a safe representation rather than placing it inside a quoted source literal.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| active_service_report = active_service_search( | ||
| hosts=targets_for_tools, | ||
| timeout=min(2.0, max(0.5, dns_timeout)), |
There was a problem hiding this comment.
When the target has no PTR record, the ARP fallback appends unrelated local-network neighbors to live_host_list, and targets_for_tools consequently includes them when no DC is detected. Passing that list here makes the default --active-search careful mode probe 28 ports on hosts that were never resolved from the supplied target, even when --scan-derived-networks is absent; build the careful-mode host list directly from the resolved target addresses and detected DCs.
Useful? React with 👍 / 👎.
| or item.get("cve") | ||
| or item.get("id") | ||
| ) | ||
| if not cve_id and isinstance(cve_obj.get("CVE_data_meta"), dict): | ||
| cve_id = cve_obj["CVE_data_meta"].get("ID") |
There was a problem hiding this comment.
For an NVD 1.1 corpus using the supported CVE_Items format, each record stores its ID at cve.CVE_data_meta.ID rather than cve.id. Here item.get("cve") assigns the entire nested dictionary to cve_id, so the subsequent CVE_data_meta fallback is skipped and the non-string check discards every record; avoid treating the nested cve object itself as an ID before applying the legacy fallback.
Useful? React with 👍 / 👎.
| def load_passive_cve_corpus(corpus_path: str | None = None, limit: int = PASSIVE_CVE_DEFAULT_LIMIT) -> dict[str, Any]: | ||
| limit = max(1, min(int(limit), PASSIVE_CVE_DEFAULT_LIMIT)) | ||
| records = _builtin_cve_corpus(limit) |
There was a problem hiding this comment.
When --passive-cve-limit is 176 or lower, the built-in registry/catalogs consume the entire limit here before the configured --passive-cve-corpus is read. Thus a user who supplies a small local corpus to constrain the scan receives zero records from that file, even if it contains the only relevant CVE; explicit corpus records need precedence or a separate allocation within the limit.
Useful? React with 👍 / 👎.
| matches_by_target.setdefault(target, []).append({ | ||
| "target": target, | ||
| "cve": record["cve"], | ||
| "status": "possible", |
There was a problem hiding this comment.
When multiple observations on one host share a product token—for example Apache on ports 80 and 443—the same corpus record is appended once for each observation. This produces duplicate CVE findings in the report and database, inflates possible_count, and can let duplicates consume the per-target 250-result cap before distinct CVEs are included; aggregate evidence under a (target, cve) key before applying the cap.
Useful? React with 👍 / 👎.
| "139": {"netbios", "smb", "samba", "windows"}, | ||
| "143": {"imap", "mail"}, | ||
| "389": {"ldap", "active-directory", "windows"}, | ||
| "443": {"https", "http", "web", "iis", "apache", "nginx", "openssl"}, |
There was a problem hiding this comment.
Whenever port 443 is reachable, these aliases add iis, apache, nginx, and openssl to the evidence simultaneously, even though the active probe performs no TLS handshake or product detection. A single generic HTTPS endpoint can therefore produce possible matches for CVEs from several mutually exclusive server products; retain only protocol-level aliases until a banner or fingerprint identifies the implementation.
Useful? React with 👍 / 👎.
| tokens = ( | ||
| _cve_text_tokens(name, component, tags, item.get("family"), item.get("affected_versions")) | ||
| | _cpe_product_tokens(cpes) | ||
| ) - _GENERIC_CVE_TOKENS |
There was a problem hiding this comment.
For a supported simple corpus record containing only a CVE ID and description, or an NVD record without CPE configuration data, the product named in the parsed description is never added to tokens. Since the fallback name is just the CVE ID and the other metadata fields are empty, such a record can never match any service evidence; include the normalized description when deriving tokens.
Useful? React with 👍 / 👎.
2 participants
Summary
adpentest/cve_catalog_100.py.ADCVERegistryentries.adpentestand bumps the package version to 1.1.4.Validation notes
ADCVERegistrysection, including ZeroLogon, PrintNightmare, Certifried, the existing Exchange entries, and the existing 2024 LDAP entries.