feat(detector): enrich MITRE CVE v5 via vuls2 instead of go-cve-dictionary

Add MITRE CVE v5 (mitre-cve-v5) as a vuls2 enrich data source and remove the
MITRE path from FillCvesWithGoCVEDictionary so MITRE CveContent is now sourced
from the vuls2 DB. This mirrors the NVD migration in #2575.

- vuls2.go: add sourceTypes.MitreCVEV5 to the enrich DataSources filter.
- vendor.go: add enrichMitreCVE mapping unified content to models.Mitre
  CveContent, and a Mitre case in cveContentSourceLink.
- detector.go / models/utils.go: drop ConvertMitreToModel and its usage.
- testdata: add a positive mitre-cve-v5 enrich test (CVE-2023-44487); move the
  "datasource not in filter" case to a new nvd-api-cve fixture.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: MaineK00n

detector/detector.go

@@ -405,8 +405,8 @@ func DetectWordPressCves(r *models.ScanResult, wpCnf config.WpScanConf) error {
 	return nil
 }
 
-// FillCvesWithGoCVEDictionary fills CVE detail with VulnCheck, JVN, EUVD, Fortinet, MITRE, Paloalto, Cisco
-// (NVD CveContent/exploits/mitigations are filled by the vuls2 enrich path instead; NVD cert alerts still come from here)
+// FillCvesWithGoCVEDictionary fills CVE detail with VulnCheck, JVN, EUVD, Fortinet, Paloalto, Cisco
+// (NVD and MITRE CveContent are filled by the vuls2 enrich path instead; JP-CERT alerts still come from here)
 func FillCvesWithGoCVEDictionary(r *models.ScanResult, cnf config.GoCveDictConf, logOpts logging.LogOpts) (err error) {
 	cveIDs := make([]string, 0, len(r.ScannedCves))
 	for _, v := range r.ScannedCves {
@@ -433,7 +433,6 @@ func FillCvesWithGoCVEDictionary(r *models.ScanResult, cnf config.GoCveDictConf,
 		jvns := models.ConvertJvnToModel(d.CveID, d.Jvns)
 		euvds := models.ConvertEuvdToModel(d.CveID, d.Euvds)
 		fortinets := models.ConvertFortinetToModel(d.CveID, d.Fortinets)
-		mitres := models.ConvertMitreToModel(d.CveID, d.Mitres)
 		paloaltos := models.ConvertPaloaltoToModel(d.CveID, d.Paloaltos)
 		ciscos := models.ConvertCiscoToModel(d.CveID, d.Ciscos)
 
@@ -462,9 +461,6 @@ func FillCvesWithGoCVEDictionary(r *models.ScanResult, cnf config.GoCveDictConf,
 						}
 					}
 				}
-				for _, con := range mitres {
-					vinfo.CveContents[con.Type] = append(vinfo.CveContents[con.Type], con)
-				}
 				// Set only JP-CERT; US-CERT is filled by the vuls2 enrich path
 				// (vuls2.EnrichVulnInfos runs before this) and must be preserved.
 				vinfo.AlertDict.JPCERT = alerts.JPCERT

detector/vuls2/testdata/fixtures/enrich/mitre-cve-v5/data/CVE-2024-1102.json

@@ -0,0 +1,18 @@
+{
+	"id": "CVE-2020-0001",
+	"vulnerabilities": [
+		{
+			"content": {
+				"id": "CVE-2020-0001",
+				"title": "from nvd-api-cve",
+				"description": "This data source is not in the enrich DataSources filter, so it should never reach enrichVulnerabilities."
+			}
+		}
+	],
+	"data_source": {
+		"id": "nvd-api-cve",
+		"raws": [
+			"fixtures/CVE-2020-0001.json"
+		]
+	}
+}

detector/vuls2/testdata/fixtures/enrich/nvd-api-cve/data/CVE-2020-0001.json

@@ -0,0 +1,4 @@
+{
+	"id": "nvd-api-cve",
+	"name": "NVD CVE API"
+}

detector/vuls2/testdata/fixtures/enrich/nvd-api-cve/datasource.json

@@ -649,6 +649,8 @@ func cveContentSourceLink(ccType models.CveContentType, v vulnerabilityTypes.Vul
 		return fmt.Sprintf("https://security.alpinelinux.org/vuln/%s", v.Content.ID)
 	case models.Nvd:
 		return fmt.Sprintf("https://nvd.nist.gov/vuln/detail/%s", v.Content.ID)
+	case models.Mitre:
+		return fmt.Sprintf("https://www.cve.org/CVERecord?id=%s", v.Content.ID)
 	case models.Microsoft:
 		return fmt.Sprintf("https://msrc.microsoft.com/update-guide/vulnerability/%s", v.Content.ID)
 	default:
@@ -1168,6 +1170,8 @@ func enrichVulnerabilities(vi *models.VulnInfo, vulns []dbTypes.VulnerabilityDat
 				enrichRedHatCVE(vi, rootMap)
 			case sourceTypes.NVDFeedCVEv2:
 				enrichNVD(vi, rootMap)
+			case sourceTypes.MitreCVEV5:
+				enrichMitreCVE(vi, rootMap)
 			case sourceTypes.Metasploit:
 				enrichMetasploit(vi, rootMap)
 			case sourceTypes.ExploitExploitDB, sourceTypes.ExploitGitHub, sourceTypes.ExploitInTheWild, sourceTypes.ExploitTrickest, sourceTypes.NucleiRepository:
@@ -1378,6 +1382,60 @@ func enrichNVD(vi *models.VulnInfo, rootMap map[dataTypes.RootID][]vulnerability
 	}
 }
 
+// enrichMitreCVE adds MITRE CVE v5 data as CveContent.
+func enrichMitreCVE(vi *models.VulnInfo, rootMap map[dataTypes.RootID][]vulnerabilityTypes.Vulnerability) {
+	if _, ok := vi.CveContents[models.Mitre]; ok {
+		return
+	}
+	for _, vulns := range rootMap {
+		for _, v := range vulns {
+			cvss2, cvss3, cvss40 := enrichCvss(v.Content.Severity)
+
+			var rs models.References
+			for _, r := range v.Content.References {
+				rs = append(rs, toReference(r.URL))
+			}
+
+			vi.CveContents[models.Mitre] = append(vi.CveContents[models.Mitre], models.CveContent{
+				Type:           models.Mitre,
+				CveID:          string(v.Content.ID),
+				Title:          v.Content.Title,
+				Summary:        v.Content.Description,
+				Cvss2Score:     cvss2.BaseScore,
+				Cvss2Vector:    cvss2.Vector,
+				Cvss2Severity:  cvss2.NVDBaseSeverity,
+				Cvss3Score:     cvss3.BaseScore,
+				Cvss3Vector:    cvss3.Vector,
+				Cvss3Severity:  cvss3.BaseSeverity,
+				Cvss40Score:    cvss40.Score,
+				Cvss40Vector:   cvss40.Vector,
+				Cvss40Severity: cvss40.Severity,
+				SourceLink:     cveContentSourceLink(models.Mitre, v),
+				References:     rs,
+				CweIDs: func() []string {
+					var cs []string //nolint:prealloc
+					for _, cwe := range v.Content.CWE {
+						cs = append(cs, cwe.CWE...)
+					}
+					return cs
+				}(),
+				Published: func() time.Time {
+					if v.Content.Published != nil {
+						return *v.Content.Published
+					}
+					return time.Date(1000, time.January, 1, 0, 0, 0, 0, time.UTC)
+				}(),
+				LastModified: func() time.Time {
+					if v.Content.Modified != nil {
+						return *v.Content.Modified
+					}
+					return time.Date(1000, time.January, 1, 0, 0, 0, 0, time.UTC)
+				}(),
+			})
+		}
+	}
+}
+
 // enrichVulnerabilityKEV extracts KEV data from vulnerability content and maps it to models.KEV.
 // Handles CISA and VulnCheck KEV sources where KEV data is stored in vulnerability content.
 func enrichVulnerabilityKEV(sourceID sourceTypes.SourceID, rootMap map[dataTypes.RootID][]vulnerabilityTypes.Vulnerability) []models.KEV {

detector/vuls2/vendor.go

@@ -1806,6 +1806,7 @@ func enrich(sesh *session.Session, vim models.VulnInfos) error {
 				sourceTypes.ExploitInTheWild,
 				sourceTypes.ExploitTrickest,
 				sourceTypes.Metasploit,
+				sourceTypes.MitreCVEV5,
 				sourceTypes.NVDFeedCVEv2,
 				sourceTypes.NucleiRepository,
 				sourceTypes.RedHatCVE,

detector/vuls2/vuls2.go

@@ -11146,7 +11146,7 @@ func Test_enrich(t *testing.T) {
 			want: models.VulnInfos{},
 		},
 		{
-			name: "datasource not in enrich filter is filtered out",
+			name: "enrich with mitre-cve-v5 data",
 			args: args{
 				vim: models.VulnInfos{
 					"CVE-2023-44487": models.VulnInfo{
@@ -11156,7 +11156,41 @@ func Test_enrich(t *testing.T) {
 			},
 			want: models.VulnInfos{
 				"CVE-2023-44487": models.VulnInfo{
-					CveID:       "CVE-2023-44487",
+					CveID: "CVE-2023-44487",
+					CveContents: models.CveContents{
+						models.Mitre: []models.CveContent{
+							{
+								Type:          models.Mitre,
+								CveID:         "CVE-2023-44487",
+								Title:         "HTTP/2 Rapid Reset Attack",
+								Summary:       "The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.",
+								Cvss3Score:    7.5,
+								Cvss3Vector:   "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+								Cvss3Severity: "HIGH",
+								SourceLink:    "https://www.cve.org/CVERecord?id=CVE-2023-44487",
+								References: models.References{
+									{Link: "https://www.cve.org/CVERecord?id=CVE-2023-44487", Source: "CVE", RefID: "CVE-2023-44487"},
+								},
+								Published:    time.Date(2023, 10, 10, 0, 0, 0, 0, time.UTC),
+								LastModified: time.Date(1000, 1, 1, 0, 0, 0, 0, time.UTC),
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "datasource not in enrich filter is filtered out",
+			args: args{
+				vim: models.VulnInfos{
+					"CVE-2020-0001": models.VulnInfo{
+						CveID: "CVE-2020-0001",
+					},
+				},
+			},
+			want: models.VulnInfos{
+				"CVE-2020-0001": models.VulnInfo{
+					CveID:       "CVE-2020-0001",
 					CveContents: models.CveContents{},
 				},
 			},

detector/vuls2/vuls2_test.go

@@ -350,125 +350,6 @@ func ConvertFortinetToModel(cveID string, fortinets []cvedict.Fortinet) []CveCon
 	return cves
 }
 
-// ConvertMitreToModel convert Mitre to CveContent
-func ConvertMitreToModel(cveID string, mitres []cvedict.Mitre) []CveContent {
-	var cves []CveContent
-	for _, mitre := range mitres {
-		for _, c := range mitre.Containers {
-			cve := CveContent{
-				Type:  Mitre,
-				CveID: cveID,
-				Title: func() string {
-					if c.Title != nil {
-						return *c.Title
-					}
-					return ""
-				}(),
-				Summary: func() string {
-					for _, d := range c.Descriptions {
-						if d.Lang == "en" {
-							return d.Value
-						}
-					}
-					return ""
-				}(),
-				SourceLink: fmt.Sprintf("https://www.cve.org/CVERecord?id=%s", cveID),
-				Published: func() time.Time {
-					if mitre.CVEMetadata.DatePublished != nil {
-						return *mitre.CVEMetadata.DatePublished
-					}
-					return time.Time{}
-				}(),
-				LastModified: func() time.Time {
-					if mitre.CVEMetadata.DateUpdated != nil {
-						return *mitre.CVEMetadata.DateUpdated
-					}
-					if mitre.CVEMetadata.DatePublished != nil {
-						return *mitre.CVEMetadata.DatePublished
-					}
-					return time.Time{}
-				}(),
-				Optional: map[string]string{"source": func() string {
-					if c.ProviderMetadata.ShortName != nil {
-						return fmt.Sprintf("%s:%s", c.ContainerType, *c.ProviderMetadata.ShortName)
-					}
-					return fmt.Sprintf("%s:%s", c.ContainerType, c.ProviderMetadata.OrgID)
-				}()},
-			}
-
-			for _, m := range c.Metrics {
-				if m.CVSSv2 != nil {
-					cve.Cvss2Score = m.CVSSv2.BaseScore
-					cve.Cvss2Vector = m.CVSSv2.VectorString
-				}
-				if m.CVSSv30 != nil {
-					if cve.Cvss3Vector == "" {
-						cve.Cvss3Score = m.CVSSv30.BaseScore
-						cve.Cvss3Vector = m.CVSSv30.VectorString
-						cve.Cvss3Severity = m.CVSSv30.BaseSeverity
-					}
-				}
-				if m.CVSSv31 != nil {
-					cve.Cvss3Score = m.CVSSv31.BaseScore
-					cve.Cvss3Vector = m.CVSSv31.VectorString
-					cve.Cvss3Severity = m.CVSSv31.BaseSeverity
-				}
-				if m.CVSSv40 != nil {
-					cve.Cvss40Score = m.CVSSv40.BaseScore
-					cve.Cvss40Vector = m.CVSSv40.VectorString
-					cve.Cvss40Severity = m.CVSSv40.BaseSeverity
-				}
-				if m.SSVC != nil {
-					cve.SSVC = &SSVC{
-						Exploitation: func() string {
-							if m.SSVC.Exploitation != nil {
-								return *m.SSVC.Exploitation
-							}
-							return ""
-						}(),
-						Automatable: func() string {
-							if m.SSVC.Automatable != nil {
-								return *m.SSVC.Automatable
-							}
-							return ""
-						}(),
-						TechnicalImpact: func() string {
-							if m.SSVC.TechnicalImpact != nil {
-								return *m.SSVC.TechnicalImpact
-							}
-							return ""
-						}(),
-					}
-				}
-			}
-
-			for _, r := range c.References {
-				cve.References = append(cve.References, Reference{
-					Link:   r.Link,
-					Source: r.Source,
-					Tags: func() []string {
-						if len(r.Tags) > 0 {
-							return strings.Split(r.Tags, ",")
-						}
-						return nil
-					}(),
-				})
-			}
-
-			for _, p := range c.ProblemTypes {
-				for _, d := range p.Descriptions {
-					if d.CweID != nil {
-						cve.CweIDs = append(cve.CweIDs, *d.CweID)
-					}
-				}
-			}
-
-			cves = append(cves, cve)
-		}
-	}
-	return cves
-}
-
 // ConvertPaloaltoToModel convert Paloalto to CveContent
 func ConvertPaloaltoToModel(cveID string, paloaltos []cvedict.Paloalto) []CveContent {
 	cves := make([]CveContent, 0, len(paloaltos))