Skip to content

[FEATURE] Allow responses to be filtered by JSON key values #152

Description

@leaf06

Is there an existing issue for this?

  • I have searched the existing issues

Issue / Request Related to a Problem?

As a user I may only be interested in certain parts of a JSON response. For example when I query the CLI with a command, I receive the full output. The CLI should allow me to specify only the key value I am interested in such as "timeline" or "max_exploit_maturity" and just receive that key value.

vulncheck index list exploits --cve CVE-2024-9644

Response:

[
  {
    "_timestamp": "2024-10-10T12:29:52.670589716Z",
    "commercial_exploit_found": true,
    "counts": {
      "botnets": 0,
      "exploits": 1,
      "ransomware_families": 0,
      "threat_actors": 0
    },
    "date_added": "2024-10-09T00:00:00Z",
    "exploits": [
      {
        "clone_ssh_url": "git@git.vulncheck.com:vulncheck/initial-access.git",
        "date_added": "2024-10-09T00:00:00Z",
        "exploit_availability": "commercially-available",
        "exploit_maturity": "weaponized",
        "exploit_type": "initial-access",
        "name": "Four-Faith Auth Bypass via Hidden API",
        "refsource": "vulncheck-initial-access",
        "url": "https://api.vulncheck.com/v3/index/initial-access?cve=CVE-2024-9644"
      }
    ],
    "id": "CVE-2024-9644",
    "inKEV": false,
    "inVCKEV": false,
    "max_exploit_maturity": "weaponized",
    "public_exploit_found": false,
    "reported_exploited": false,
    "reported_exploited_by_botnets": false,
    "reported_exploited_by_ransomware": false,
    "reported_exploited_by_threat_actors": false,
    "timeline": {
      "first_exploit_published": "2024-10-09T00:00:00Z",
      "first_exploit_published_weaponized_or_higher": "2024-10-09T00:00:00Z",
      "most_recent_exploit_published": "2024-10-09T00:00:00Z"
    },
    "trending": {
      "github": false
    },
    "weaponized_exploit_found": true
  }
]

Solution

Example 1:
vulncheck index list exploits --cve CVE-2024-9644 ---timeline

Response:

      "first_exploit_published": "2024-10-09T00:00:00Z",
      "first_exploit_published_weaponized_or_higher": "2024-10-09T00:00:00Z",
      "most_recent_exploit_published": "2024-10-09T00:00:00Z"

Example 2:

vulncheck index list exploits --cve CVE-2024-9644 ---public_exploit_found

Response:

false

Additional Context

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions