> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/Gowtham-Darkseid/AutoPentestX/llms.txt
> Use this file to discover all available pages before exploring further.

# CVE Lookup Module

> Automated CVE database lookup with CVSS scoring and exploit matching

## Overview

The CVE Lookup module (`modules/cve_lookup.py`) queries public CVE databases to identify known vulnerabilities in discovered services. It provides CVSS scoring, exploit availability checking, and risk assessment.

## CVELookup Class

Defined at `cve_lookup.py:13`, this class handles all CVE database interactions.

### Initialization

```python cve_lookup.py:14-18 theme={null}
class CVELookup:
    def __init__(self):
        """Initialize CVE lookup module"""
        self.cve_data = []
        self.api_url = "https://cve.circl.lu/api"
        self.nvd_api = "https://services.nvd.nist.gov/rest/json/cves/2.0"
```

**CVE Data Sources:**

1. **CVE CIRCL API** (primary): Fast, no authentication required
2. **NVD API** (fallback): National Vulnerability Database with detailed metrics

## Key Methods

### search\_cve\_by\_product()

Searches CVE databases for vulnerabilities affecting a specific product and version.

```python cve_lookup.py:20-64 theme={null}
def search_cve_by_product(self, product, version=""):
    """Search for CVEs by product name and version"""
    # Clean product name
    product_clean = product.lower().strip()
    product_clean = re.sub(r'[^\w\s-]', '', product_clean)
    
    # Query CVE CIRCL API
    search_url = f"{self.api_url}/search/{product_clean}"
    response = requests.get(search_url, timeout=10)
    
    if response.status_code == 200:
        data = response.json()
        
        # Limit to top 10 most relevant results
        for cve_entry in data[:10]:
            cve_info = self.parse_cve_entry(cve_entry)
            
            # Filter by version if specified
            if version and self.version_matches(cve_entry, version):
                cves.append(cve_info)
            else:
                cves.append(cve_info)
    
    return cves
```

<ParamField path="product" type="string" required>
  Product name (e.g., "apache", "openssh", "mysql")
</ParamField>

<ParamField path="version" type="string">
  Product version for filtering results (e.g., "2.4.41")
</ParamField>

### parse\_cve\_entry()

Extracts and normalizes CVE information from API responses.

```python cve_lookup.py:66-111 theme={null}
def parse_cve_entry(self, cve_entry):
    """Parse CVE entry and extract relevant information"""
    cve_id = cve_entry.get('id', 'Unknown')
    summary = cve_entry.get('summary', 'No description available')
    
    # Get CVSS score
    cvss_score = 0.0
    if 'cvss' in cve_entry:
        cvss_score = float(cve_entry.get('cvss', 0.0))
    elif 'impact' in cve_entry:
        if 'baseMetricV3' in cve_entry['impact']:
            cvss_score = float(cve_entry['impact']['baseMetricV3']['cvssV3']['baseScore'])
        elif 'baseMetricV2' in cve_entry['impact']:
            cvss_score = float(cve_entry['impact']['baseMetricV2']['cvssV2']['baseScore'])
    
    # Determine risk level
    risk_level = self.calculate_risk_level(cvss_score)
    
    # Check exploit availability
    exploitable = self.check_exploit_availability(cve_id, cve_entry)
    
    return {
        'cve_id': cve_id,
        'description': summary[:500],
        'cvss_score': cvss_score,
        'risk_level': risk_level,
        'published_date': published,
        'exploitable': exploitable,
        'references': cve_entry.get('references', [])[:3]
    }
```

## CVSS Score Interpretation

### calculate\_risk\_level()

Maps CVSS scores to risk severity levels.

```python cve_lookup.py:113-124 theme={null}
def calculate_risk_level(self, cvss_score):
    """Calculate risk level based on CVSS score"""
    if cvss_score >= 9.0:
        return "CRITICAL"
    elif cvss_score >= 7.0:
        return "HIGH"
    elif cvss_score >= 4.0:
        return "MEDIUM"
    elif cvss_score > 0.0:
        return "LOW"
    else:
        return "UNKNOWN"
```

**CVSS v3 Severity Ratings:**

| Score Range | Severity      | Color  | Priority                  |
| ----------- | ------------- | ------ | ------------------------- |
| 9.0 - 10.0  | CRITICAL      | Red    | Immediate action required |
| 7.0 - 8.9   | HIGH          | Orange | Fix within 30 days        |
| 4.0 - 6.9   | MEDIUM        | Yellow | Fix within 90 days        |
| 0.1 - 3.9   | LOW           | Blue   | Fix when convenient       |
| 0.0         | INFORMATIONAL | Gray   | No action needed          |

## Exploit Detection

### check\_exploit\_availability()

Determines if public exploits are available for a CVE.

```python cve_lookup.py:126-142 theme={null}
def check_exploit_availability(self, cve_id, cve_entry):
    """Check if exploit is publicly available"""
    # Check in CVE data
    if 'exploit-db' in str(cve_entry).lower():
        return True
    
    if 'metasploit' in str(cve_entry).lower():
        return True
    
    # Check references
    if 'references' in cve_entry:
        for ref in cve_entry['references']:
            ref_str = str(ref).lower()
            if any(keyword in ref_str for keyword in 
                ['exploit', 'poc', 'metasploit', 'exploit-db']):
                return True
    
    return False
```

**Exploit Sources Checked:**

* Exploit-DB
* Metasploit Framework
* Proof-of-Concept (PoC) repositories
* Security advisories with exploit code

## Service CVE Lookup

### lookup\_services()

Looks up CVEs for all discovered services from port scan.

```python cve_lookup.py:160-185 theme={null}
def lookup_services(self, services):
    """Look up CVEs for list of services"""
    all_cves = []
    
    for service in services:
        port = service.get('port')
        service_name = service.get('service', '')
        version = service.get('version', '')
        
        # Skip generic services
        if not service_name or service_name in ['unknown', 'tcpwrapped']:
            continue
        
        # Search for CVEs
        cves = self.search_cve_by_product(service_name, version)
        
        # Attach port information
        for cve in cves:
            cve['port'] = port
            cve['service'] = service_name
            cve['version'] = version
            all_cves.append(cve)
    
    return all_cves
```

<Note>
  The module automatically skips generic services like "unknown" or "tcpwrapped" to reduce false positives.
</Note>

## Usage Example

```python theme={null}
from modules.cve_lookup import CVELookup
from modules.scanner import Scanner

# Get services from scan
scanner = Scanner("192.168.1.100")
scan_results = scanner.run_full_scan()

# Look up CVEs
cve_lookup = CVELookup()
cves = cve_lookup.lookup_services(scan_results['services'])

# Display results
for cve in cves:
    print(f"Port {cve['port']}: {cve['cve_id']}")
    print(f"  Service: {cve['service']} {cve['version']}")
    print(f"  CVSS: {cve['cvss_score']} ({cve['risk_level']})")
    print(f"  Exploitable: {cve['exploitable']}")
    print(f"  Description: {cve['description']}")
```

## Output Format

```json theme={null}
[
  {
    "port": 22,
    "service": "ssh",
    "version": "OpenSSH 7.4",
    "cve_id": "CVE-2018-15473",
    "description": "OpenSSH through 7.7 allows remote attackers to enumerate users...",
    "cvss_score": 5.3,
    "risk_level": "MEDIUM",
    "published_date": "2018-08-17",
    "exploitable": true,
    "references": [
      "https://github.com/Rhynorater/CVE-2018-15473-Exploit",
      "https://nvd.nist.gov/vuln/detail/CVE-2018-15473"
    ]
  }
]
```

## Rate Limiting

The module implements rate limiting to respect API usage policies:

```python cve_lookup.py:56-57 theme={null}
# Rate limiting between requests
time.sleep(1)  # 1 second delay per request
```

<Warning>
  Excessive API requests may result in temporary IP blocking. The built-in rate limiting prevents this.
</Warning>

## Configuration

CVE lookup settings in `config.json`:

```json config.json theme={null}
{
  "cve_lookup": {
    "enabled": true,
    "api_url": "https://cve.circl.lu/api",
    "nvd_api_url": "https://services.nvd.nist.gov/rest/json/cves/2.0",
    "max_results_per_service": 10,
    "cache_results": true
  }
}
```

<ParamField path="enabled" type="boolean" default={true}>
  Enable/disable CVE lookup during scans
</ParamField>

<ParamField path="max_results_per_service" type="number" default={10}>
  Maximum CVEs to return per service (prevents overwhelming results)
</ParamField>

<ParamField path="cache_results" type="boolean" default={true}>
  Cache CVE data to reduce API calls
</ParamField>

## Error Handling

<AccordionGroup>
  <Accordion title="API Timeout">
    Requests timeout after 10 seconds. Returns empty results and continues scanning.

    ```python theme={null}
    response = requests.get(search_url, timeout=10)
    ```
  </Accordion>

  <Accordion title="No Results Found">
    Returns empty list if no CVEs match the service/version.

    **Common causes:**

    * Service version too new (no CVEs yet)
    * Product name not in CVE database
    * Version string parsing failed
  </Accordion>

  <Accordion title="Network Error">
    Catches connection errors and continues scan.

    ```python theme={null}
    except requests.exceptions.RequestException as e:
        print(f"[!] CVE lookup failed: {e}")
        return []
    ```
  </Accordion>
</AccordionGroup>

## Related Documentation

<CardGroup cols={2}>
  <Card title="Risk Engine" icon="chart-line" href="/modules/risk-engine">
    How CVE data is used in risk scoring
  </Card>

  <Card title="Exploit Engine" icon="bug" href="/modules/exploit-engine">
    Matching CVEs to available exploits
  </Card>

  <Card title="PDF Reports" icon="file-pdf" href="/output/pdf-reports">
    CVE information in generated reports
  </Card>

  <Card title="Configuration" icon="gear" href="/configuration/settings">
    CVE lookup settings
  </Card>
</CardGroup>