The Wayback Machine - https://web.archive.org/web/20210720211355/https://github.com/OWASP/wstg/issues/360
Skip to content

/ wstg

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Common Platform Enumeration (CPE) naming schema on information gathering process #360

Open
1 task done
jespunya opened this issue Mar 13, 2020 · 14 comments
Open
1 task done

Common Platform Enumeration (CPE) naming schema on information gathering process #360

jespunya opened this issue Mar 13, 2020 · 14 comments
Assignees
@jespunya
Labels
good first issue new
Milestone
v5.0 Release

Comments

@jespunya
Copy link
Task lists! Give feedback
Contributor

@jespunya jespunya commented Mar 13, 2020 •
edited

What would you like added?
Common Platform Enumeration (CPE) is a structured naming scheme for information technology systems, software, and packages. Based upon the generic syntax for Uniform Resource Identifiers (URI), CPE includes a formal name format, a method for checking names against a system, and a description format for binding text and tests to a name.

The usage of CPE naming is especially important to boost the integration of multiple tools during the automatization of testing. Actually, several widely used security tools provide it's inventories based on CPE encoding.

An example of CPE naming would be the representation of: Microsoft Internet Explorer 8.0.6001 Beta as:

wfn:[part="a",vendor="microsoft",product="internet_explorer",
version="8\.0\.6001",update="beta"]

Or the most commonly found:

cpe:/a:microsoft:internet_explorer:8.0.6001:beta

I think that would be important that any WSTG reader would be introduced to those naming scheme in order to know what it is and how to use it, as well as encourage developers security testing tools to integrate the usage of CPE on its tools for better integration with other databases and tools.

Do you think that it would be interesting?
If you would like to introduce it, where do you think that it would feed the best inside the guide?

My proposal would be:

  1. Add a new appending to the guide with the explanation of the Common Platform Enumeration (CPE)
  2. Softly integrate through examples the usage of CPE on the section 4.2 of the guide, especially on the modules 4.2.2, 4.2.4, 4.2.8 and 4.2.9. This softly integration would consist on providing the corresponding cpe names for the frameworks and technologies mentioned at the examples of those modules.

Would you like to be assigned to this issue?

  • Assign me, please!
@jespunya jespunya added the new label Mar 13, 2020
@ThunderSon
Copy link
Collaborator

@ThunderSon ThunderSon commented Mar 13, 2020 •
edited

I'd really this topic to be injected into the WSTG.
Points to consider:

  • We need to define properly where to inject its definition - could be in an appendix, in a chapter in 4.2, etc. - to properly allow the reader to go through it and use it.
  • The document gets updated incrementally to entertain this topic and properly use CPE across its chapters.
  • Be ready by the v5 release to properly contain CPE.

Why I enjoy this topic?
Readers will be able to:

  • automate tasks by injecting CPEs into scanners.
  • write more professional reports.
  • search for exact application under databases using CPEs.
  • Broaden their knowledge by learning this standard.

Looking forward for more opinions and actionable points on this 😄
@kingthorin
Copy link
Collaborator

@kingthorin kingthorin commented Mar 14, 2020

I have no further context for this tweet right now just wanted to keep track of it somehow: https://mobile.twitter.com/manicode/status/1238835388757823493
@ThunderSon
Copy link
Collaborator

@ThunderSon ThunderSon commented Mar 14, 2020

@stevespringett @jmanico would you be able to provide us with input on the above topic?
@stevespringett
Copy link

@stevespringett stevespringett commented Mar 14, 2020

In general, a section on naming would be good. CPE is one method of naming. There are others including Package URL and SWID.

CPE is inherently flawed. It's centralized. The vendor/product/versions often do not reflect reality. And most importantly, CPEs are typically not created until a CVE is created. So it's not an authoritative source of software, rather vulnerable software.

Naming is hard. Vendors get merged, acquired, products are renamed, etc. Currently, a global alias list does not exist. These are all known problems. A global namespace has only been created once - DNS. The software equivalent of this does not currently exist.

IMO, a section on naming would be good which references to the various methods in which software is named, including CPE, Package URL, and SWID.
@kingthorin
Copy link
Collaborator

@kingthorin kingthorin commented Mar 17, 2020 •
edited by ThunderSon

Further details on CPE/SWID concerns: https://groups.google.com/a/owasp.org/g/leaders/c/eQPCC7-nQj4/m/WMYVLMmSAgAJ
@kingthorin
Copy link
Collaborator

@kingthorin kingthorin commented Jun 14, 2020

@jespunya are you going to be able to tackle this?
@jespunya
Copy link
Contributor Author

@jespunya jespunya commented Jun 29, 2020

@kingthorin I still think that it would be interesting, but I don't have a clear idea about how to address it.
What would be your idea? Maybe a subsection of the section 5 (Reporting) exposing what's Naming, it's usages and limitations and a introduction to the CPE, Package URL & SWID proposed by @stevespringett? Any other idea?
@ThunderSon
Copy link
Collaborator

@ThunderSon ThunderSon commented Jul 1, 2020

I would scrap CPE as it's going to be deprecated and move forward with it. @stevespringett what would you advise for this call?
@stevespringett
Copy link

@stevespringett stevespringett commented Jul 1, 2020

CPE will be around for a few more years. The NVD will be supporting it while they migrate to SWID and commercial sources of vulnerability intelligence (VulnDB, Secunia, etc) continue to support it. So for the foreseeable future, I would include CPE, SWID, and PURL.

https://cyclonedx.org/use-cases/#known-vulnerabilities has some recommendations on which of these three to use based on the type of software being represented.
@jespunya
Copy link
Contributor Author

@jespunya jespunya commented Jul 1, 2020

Thanks @stevespringett I will try to make a first version during the following days so we could have something more specific to talk about it.
@ThunderSon
Copy link
Collaborator

@ThunderSon ThunderSon commented Jul 3, 2020

@jespunya if you require any help or support, ping away :) Thanks for tackling this!
@github-actions
Copy link

@github-actions github-actions bot commented Aug 15, 2020

Please comment if you are still working on this issue, as it has been inactive for 30 days. To give everyone a chance to contribute, we are releasing it to new contributors.
@kingthorin kingthorin added this to the v5.0 Release milestone Nov 10, 2020
@jespunya jespunya mentioned this issue Jan 28, 2021
Open
2 tasks
@github-actions
Copy link

@github-actions github-actions bot commented Apr 15, 2021

Please comment if you are still working on this issue, as it has been inactive for 30 days. To give everyone a chance to contribute, we are releasing it to new contributors.
@github-actions
Copy link

@github-actions github-actions bot commented Jun 15, 2021

Please comment if you are still working on this issue, as it has been inactive for 30 days. To give everyone a chance to contribute, we are releasing it to new contributors.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
good first issue new
4 participants
@stevespringett @jespunya @kingthorin @ThunderSon