From CVE Finding to Fixed Release: Auditing Vulnerabilities in YugabyteDB and YBA

				
					#!/bin/bash

# ==============================================================================
# YugabyteDB Vulnerability Toolkit (ybcve.sh)
# Uses public internet APIs to track YugabyteDB, Supply Chain, and Go CVEs.
# ==============================================================================

# Defaults
MODE="search"
OUTPUT="text"
SHORT_FORMAT=false
MONITOR_FILE=".ybcve_state.txt"
KEYWORD="Yugabyte"
SUPPLY_CHAIN_ID=""
CVE_ID_PAT=""
TITLE_PAT=""
DESC_PAT=""

# Glob to Regex helper for jq
glob_to_regex() {
    local p="$1"
    p="${p//./\\.}"
    p="${p//\*/.*}"
    p="${p//\?/.}"
    echo "$p"
}

show_help() {
    cat << EOF
YugabyteDB Vulnerability Toolkit (ybcve.sh)

DESCRIPTION:
  A CLI tool to dynamically search, export, and monitor YugabyteDB, upstream
  PostgreSQL supply-chain vulnerabilities, and third-party library CVEs.

USAGE:
  $0 [MODE] [OPTIONS]

MODES:
  -m search        (Default) Search MITRE/NVD for Yugabyte native CVEs.
  -m supply        Scrape Yugabyte Docs & MITRE for upstream Postgres CVE status.
  -m lookup        Direct MITRE/NVD lookup for any CVE ID (Go libs, runc, etc.).
  -m monitor       Run as a cron-job to track changes against baseline state.

FORMATTING OPTIONS:
  -s, --short      Display compact output (CVE ID, Title, and Description only).
  -o text          (Default) Formatted terminal output.
  -o csv           Export data as comma-separated values (for Search mode).

EXAMPLES:
  $0 -m search -k "YugabyteDB"
  $0 -m supply -c CVE-2019-10130
  $0 -m lookup -c CVE-2024-10979
  $0 -m lookup -c CVE-2020-14349
EOF
}

# Parse Arguments
while [[ "$#" -gt 0 ]]; do
    case $1 in
        -h|--help) show_help; exit 0 ;;
        -m|--mode) MODE="$2"; shift ;;
        -s|--short) SHORT_FORMAT=true ;;
        -o|--output) OUTPUT="$2"; shift ;;
        -k|--keyword) KEYWORD="$2"; shift ;;
        -i|--id) CVE_ID_PAT=$(glob_to_regex "$2"); shift ;;
        -t|--title) TITLE_PAT=$(glob_to_regex "$2"); shift ;;
        -d|--desc) DESC_PAT=$(glob_to_regex "$2"); shift ;;
        -c|--cve) SUPPLY_CHAIN_ID="$2"; shift ;;
        *) echo "Unknown parameter: $1"; exit 1 ;;
    esac
    shift
done

# ==============================================================================
# FUNCTION: Direct Single CVE Lookup (Mode: lookup)
# ==============================================================================
run_lookup() {
    if [ -z "$SUPPLY_CHAIN_ID" ]; then
        echo "Error: Lookup mode requires a CVE ID (-c). e.g., -c CVE-2024-10979"
        exit 1
    fi

    echo "Fetching direct details from MITRE for $SUPPLY_CHAIN_ID..."
    echo "--------------------------------------------------------------------------------"

    JSON=$(curl -s "https://cveawg.mitre.org/api/cve/$SUPPLY_CHAIN_ID")

    if [ -z "$JSON" ] || [ "$JSON" == "null" ] || echo "$JSON" | grep -q "error"; then
        echo "CVE ID '$SUPPLY_CHAIN_ID' not found on MITRE API."
        exit 1
    fi

    if [ "$SHORT_FORMAT" = true ]; then
        echo "$JSON" | jq -r '
          "CVE ID       : \(.cveMetadata.cveId)
Title        : \(.containers.cna.title // "No Title Provided")
Description  : \(.containers.cna.descriptions[0].value | gsub("[\n\t\r]+"; " "))"
        ' | fold -s -w 100
    else
        # 1. Fetch MITRE CVSS metrics
        METRICS_MITRE=$(echo "$JSON" | jq -r '
          def get_score:
            [
              .containers.cna.metrics[]? |
              (.cvssV4_0.baseScore, .cvssV3_1.baseScore, .cvssV3_0.baseScore, .other.content.score, (to_entries[]? | .value.baseScore?)) |
              select(. != null)
            ][0] // "N/A";

          def get_vector:
            [
              .containers.cna.metrics[]? |
              (.cvssV4_0.vectorString, .cvssV3_1.vectorString, .cvssV3_0.vectorString, (to_entries[]? | .value.vectorString?)) |
              select(. != null)
            ][0] // "N/A";

          "\(get_score)|\(get_vector)"
        ' 2>/dev/null)

        IFS='|' read -r SCORE VECTOR <<< "$METRICS_MITRE"

        # 2. Fallback to NVD if MITRE CVSS is N/A
        if [ "$SCORE" == "N/A" ]; then
            NVD_JSON=$(curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=$SUPPLY_CHAIN_ID")
            NVD_METRICS=$(echo "$NVD_JSON" | jq -r '
                .vulnerabilities[0].cve.metrics |
                [(.cvssMetricV31[]?.cvssData, .cvssMetricV30[]?.cvssData, .cvssMetricV2[]?.cvssData)] |
                .[0] |
                "\(.baseScore // "N/A")|\(.vectorString // "N/A")"
            ' 2>/dev/null)

            if [ -n "$NVD_METRICS" ] && [ "$NVD_METRICS" != "N/A|N/A" ]; then
                IFS='|' read -r SCORE VECTOR <<< "$NVD_METRICS"
            fi
        fi

        # 3. Extract description string and flatten linebreaks
        RAW_DESC=$(echo "$JSON" | jq -r '(.containers.cna.descriptions[0].value // "")' 2>/dev/null)
        DESC_FLAT=$(echo "$RAW_DESC" | tr '\n' ' ' | tr '\r' ' ' | sed -E 's/[[:space:]]+/ /g')

        # 4. Reliable sentence-isolated version token extractor
        INFERRED_FIX=""
        RAW_TOKENS=""

        # Isolate sentence with resolution verbs
        FIX_SENTENCE=$(echo "$DESC_FLAT" | perl -pe 's/(?<!\b[vV]\d)(?<!\b\d)\.(?=\s+[A-Z]|\s*$)/\n/g' | grep -iE '(patched|fixed|resolved|updated|released|includes patches|fixes)' | head -n 1)

        if [ -n "$FIX_SENTENCE" ]; then
            RAW_TOKENS=$(echo "$FIX_SENTENCE" | grep -ioP 'v?[0-9]+\.[0-9]+(\.[0-9]+)*[a-zA-Z0-9\.\-]*')
        fi

        # Boundary Matcher Fallback: Matches "before X.Y", "prior to X.Y", "thru X.Y", "up to X.Y"
        if [ -z "$RAW_TOKENS" ] && echo "$DESC_FLAT" | grep -iqE '(before|prior to|thru|through|up to) [0-9]'; then
            RAW_TOKENS=$(echo "$DESC_FLAT" | grep -ioP '(before|prior to|thru|through|up to)\s+(version|versions|v)?\s*\K[0-9]+\.[0-9]+(\.[0-9]+)*')
        fi

        # Process and format tokens cleanly into a comma-space separated list
        if [ -n "$RAW_TOKENS" ]; then
            INFERRED_FIX=$(echo "$RAW_TOKENS" | sed -E 's/[\.,]+$//' | awk 'NF' | sort -u -V | awk 'NR>1{printf ", "} {printf "%s", $0} END{print ""}')
        fi

        # 5. Render final output with Severity rating calculated
        echo "$JSON" | jq -r --arg score "$SCORE" --arg vector "$VECTOR" --arg inferred "$INFERRED_FIX" '
          def get_severity:
            if $score == "N/A" then "N/A"
            else
              ($score | tonumber) as $s |
              if $s >= 9.0 then "Critical"
              elif $s >= 7.0 then "High"
              elif $s >= 4.0 then "Medium"
              elif $s > 0.0 then "Low"
              else "None"
              end
            end;

          def get_fixes:
            if .containers.cna.affected then
              [
                .containers.cna.affected[]?.versions[]? |
                select(.status == "unaffected" or .lessThan) |
                (.lessThan // .version // empty | tostring)
              ] | unique | join(", ")
            else
              ""
            end;

          def get_product:
            [.containers.cna.affected[]?.product // empty] | unique | join(", ") | if . == "" then "Unknown" else . end;

          (get_fixes) as $raw_fix |
          (
            if $raw_fix != "" then
              $raw_fix
            elif $inferred != "" then
              "N/A (inferred " + $inferred + " from description)"
            else
              "N/A (check description for details)"
            end
          ) as $final_fix |

          "CVE ID       : \(.cveMetadata.cveId)
Title        : \(.containers.cna.title // "No Title Provided")
Product/Lib  : \(get_product)
Fixed In     : \($final_fix)
Severity     : \(get_severity)
CVSS Score   : \($score)
Vector       : \($vector)
Published    : \(.cveMetadata.datePublished // "N/A" | .[0:10])
Description  : \(.containers.cna.descriptions[0].value | gsub("[\n\t\r]+"; " "))"
        ' | fold -s -w 100
    fi

    echo "--------------------------------------------------------------------------------"
}

# ==============================================================================
# FUNCTION: Supply Chain Scraper & Enricher (Mode: supply)
# ==============================================================================
run_supply_chain() {
    if [ -n "$SUPPLY_CHAIN_ID" ]; then
        echo "Scraping Yugabyte Docs for upstream status of: $SUPPLY_CHAIN_ID..."
    else
        echo "Scraping Yugabyte Docs for ALL upstream supply-chain vulnerabilities..."
    fi

    URL="https://docs.yugabyte.com/stable/secure/vulnerability-disclosure-policy/"
    HTML=$(curl -sL "$URL")

    if [ -z "$HTML" ]; then
        echo "Error: Unable to fetch Yugabyte documentation page."
        exit 1
    fi

    echo "--------------------------------------------------------------------------------"

    # Pure POSIX AWK Stream Parser: Handles multiline <tr>/<td> tags
    PARSED_ROWS=$(echo "$HTML" | awk '
        BEGIN { IGNORECASE=1; in_table=0; row="" }
        /<table/ { in_table=1 }
        /<\/table>/ { in_table=0 }
        in_table {
            gsub(/[\r\n]+/, " ");
            row = row " " $0;
            if (row ~ /<\/tr>/) {
                print row;
                row = "";
            }
        }' | awk -F'</t[dh]>' '{
            cve = ""; prod = "PostgreSQL (YSQL)"; status = "";

            for (i=1; i<=NF; i++) {
                gsub(/<[^>]*>/, " ", $i);
                gsub(/^[ \t\r\n]+|[ \t\r\n]+$/, "", $i);
                gsub(/[ \t\r\n]+/, " ", $i);

                if ($i ~ /CVE-[0-9]{4}-[0-9]+/) {
                    match($i, /CVE-[0-9]{4}-[0-9]+/);
                    cve = substr($i, RSTART, RLENGTH);

                    if (i > 1) {
                        prod_candidate = $(i-1);
                        if (prod_candidate != "" && prod_candidate !~ /CVE-/) {
                            prod = prod_candidate;
                        }
                    }

                    for (j=i+1; j<=NF; j++) {
                        gsub(/<[^>]*>/, " ", $j);
                        gsub(/^[ \t\r\n]+|[ \t\r\n]+$/, "", $j);
                        gsub(/[ \t\r\n]+/, " ", $j);
                        if ($j != "") status = (status == "") ? $j : status " " $j;
                    }
                    break;
                }
            }
            if (cve != "") {
                printf "%s|%s|%s\n", cve, prod, status;
            }
        }')

    if [ -n "$SUPPLY_CHAIN_ID" ]; then
        MATCHES=$(echo "$PARSED_ROWS" | grep -i "$SUPPLY_CHAIN_ID")
    else
        MATCHES="$PARSED_ROWS"
    fi

    if [ -z "$MATCHES" ]; then
        echo "No matching supply-chain entries found in Yugabyte docs."
    else
        echo "$MATCHES" | while IFS='|' read -r cve prod status; do
            [ -z "$cve" ] && continue

            MITRE_JSON=$(curl -s "https://cveawg.mitre.org/api/cve/$cve")

            if [ "$SHORT_FORMAT" = true ]; then
                DESC=$(echo "$MITRE_JSON" | jq -r '(.containers.cna.descriptions[0].value // "No description available.") | gsub("[\n\t\r]+"; " ")' 2>/dev/null)
                printf "CVE ID          : %-18s\n" "$cve"
                printf "Product         : %-25s\n" "$prod"
                printf "Yugabyte Status : %-25s\n" "$status"
                echo "Description     : $DESC"
            else
                METRICS_MITRE=$(echo "$MITRE_JSON" | jq -r '
                  def get_score:
                    [
                      .containers.cna.metrics[]? |
                      (.cvssV4_0.baseScore, .cvssV3_1.baseScore, .cvssV3_0.baseScore, .other.content.score, (to_entries[]? | .value.baseScore?)) |
                      select(. != null)
                    ][0] // "N/A";

                  def get_vector:
                    [
                      .containers.cna.metrics[]? |
                      (.cvssV4_0.vectorString, .cvssV3_1.vectorString, .cvssV3_0.vectorString, (to_entries[]? | .value.vectorString?)) |
                      select(. != null)
                    ][0] // "N/A";

                  "\(get_score)|\(get_vector)"
                ' 2>/dev/null)

                IFS='|' read -r SCORE VECTOR <<< "$METRICS_MITRE"

                if [ "$SCORE" == "N/A" ]; then
                    NVD_JSON=$(curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=$cve")
                    NVD_METRICS=$(echo "$NVD_JSON" | jq -r '
                        .vulnerabilities[0].cve.metrics |
                        [(.cvssMetricV31[]?.cvssData, .cvssMetricV30[]?.cvssData, .cvssMetricV2[]?.cvssData)] |
                        .[0] |
                        "\(.baseScore // "N/A")|\(.vectorString // "N/A")"
                    ' 2>/dev/null)

                    if [ -n "$NVD_METRICS" ] && [ "$NVD_METRICS" != "N/A|N/A" ]; then
                        IFS='|' read -r SCORE VECTOR <<< "$NVD_METRICS"
                    fi
                fi

                # Calculate Severity rating
                SEVERITY="N/A"
                if [ "$SCORE" != "N/A" ]; then
                    SEVERITY=$(awk -v s="$SCORE" 'BEGIN {
                        if (s >= 9.0) print "Critical";
                        else if (s >= 7.0) print "High";
                        else if (s >= 4.0) print "Medium";
                        else if (s > 0.0) print "Low";
                        else print "None";
                    }')
                fi

                PUB_DATE=$(echo "$MITRE_JSON" | jq -r '(.cveMetadata.datePublished // "N/A") | .[0:10]' 2>/dev/null)
                DESC=$(echo "$MITRE_JSON" | jq -r '(.containers.cna.descriptions[0].value // "No description available.") | gsub("[\n\t\r]+"; " ")' 2>/dev/null)

                printf "CVE ID          : %-18s\n" "$cve"
                printf "Product         : %-25s\n" "$prod"
                printf "Yugabyte Status : %-25s\n" "$status"
                printf "Severity        : %-25s\n" "$SEVERITY"
                printf "CVSS Score      : %-25s\n" "$SCORE"
                printf "Vector          : %-25s\n" "$VECTOR"
                printf "Published       : %-25s\n" "$PUB_DATE"
                echo "Description     : $DESC"
            fi
        done | fold -s -w 100
    fi

    echo "--------------------------------------------------------------------------------"
}

# ==============================================================================
# FUNCTION: API Search & Export (Mode: search)
# ==============================================================================
run_search() {
    local SILENT=$1
    ENCODED_KEYWORD="${KEYWORD// /%20}"

    if [ "$SILENT" != "true" ]; then
        echo "Querying NVD API for seed: '$KEYWORD'..." >&2
    fi

    CVE_IDS=$(curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=${ENCODED_KEYWORD}" | jq -r '.vulnerabilities[]?.cve.id' 2>/dev/null)

    if [ -z "$CVE_IDS" ]; then
        if [ "$SILENT" != "true" ]; then echo "No CVEs found or rate limited." >&2; fi
        exit 0
    fi

    if [ "$OUTPUT" == "csv" ] && [ "$SILENT" != "true" ]; then
        echo '"CVE_ID","Title","CVSS","Vector","Published","Description"'
    elif [ "$SILENT" != "true" ]; then
        echo "Fetching records from MITRE..." >&2
        echo "--------------------------------------------------------------------------------" >&2
    fi

    for ID in $CVE_IDS; do
        JSON=$(curl -s "https://cveawg.mitre.org/api/cve/$ID")
        if [ -z "$JSON" ] || [ "$JSON" == "null" ] || echo "$JSON" | grep -q "error"; then continue; fi

        JQ_CONDITIONS="true"
        if [ -n "$CVE_ID_PAT" ]; then JQ_CONDITIONS="$JQ_CONDITIONS and (.cveMetadata.cveId | test(\"$CVE_ID_PAT\"; \"i\"))"; fi
        if [ -n "$TITLE_PAT" ]; then JQ_CONDITIONS="$JQ_CONDITIONS and ((.containers.cna.title // \"\") | test(\"$TITLE_PAT\"; \"i\"))"; fi
        if [ -n "$DESC_PAT" ]; then JQ_CONDITIONS="$JQ_CONDITIONS and ((.containers.cna.descriptions[0].value // \"\") | test(\"$DESC_PAT\"; \"i\"))"; fi

        if [ "$OUTPUT" == "csv" ]; then
            echo "$JSON" | jq -r "
                select($JQ_CONDITIONS) |
                [
                  .cveMetadata.cveId,
                  (.containers.cna.title // \"No Title Provided\"),
                  ([.containers.cna.metrics[]? | to_entries[]? | .value.baseScore? | select(. != null)][0] // \"N/A\"),
                  ([.containers.cna.metrics[]? | to_entries[]? | .value.vectorString? | select(. != null)][0] // \"N/A\"),
                  ((.cveMetadata.datePublished // \"N/A\") | .[0:10]),
                  (.containers.cna.descriptions[0].value | gsub(\"[\n\t\r\"]+\"; \" \"))
                ] | @csv
            " 2>/dev/null
        else
            if [ "$SHORT_FORMAT" = true ]; then
                OUT=$(echo "$JSON" | jq -r '
                    select('"$JQ_CONDITIONS"') |
"CVE ID      : \(.cveMetadata.cveId)
Title       : \(.containers.cna.title // "No Title Provided")
Description : \(.containers.cna.descriptions[0].value | gsub("[\n\t\r]+"; " "))"
                ' 2>/dev/null)
            else
                OUT=$(echo "$JSON" | jq -r '
                    def get_score:
                      [.containers.cna.metrics[]? | to_entries[]? | .value.baseScore? | select(. != null)][0] // "N/A";
                    def get_vector:
                      [.containers.cna.metrics[]? | to_entries[]? | .value.vectorString? | select(. != null)][0] // "N/A";
                    def get_versions:
                      if .containers.cna.affected then
                        (.containers.cna.affected[] |
                          "  Product  : \(.product // "Unknown")\n  Affected : " +
                          ([.versions[]? | select(.status == "affected") | "\(.version)" + (if .lessThan then " (up to \(.lessThan))" else "" end)] | join(", ") | if . == "" then "None listed" else . end) + "\n  Fixed    : " +
                          ([.versions[]? | select(.status == "unaffected") | "\(.version)"] | join(", ") | if . == "" then "None listed" else . end)
                        )
                      else
                        "  No version data provided."
                      end;

                    select('"$JQ_CONDITIONS"') |
"CVE ID       : \(.cveMetadata.cveId)
Title        : \(.containers.cna.title // "No Title Provided")
CVSS Score   : \(get_score)
Vector       : \(get_vector)
Published    : \(.cveMetadata.datePublished // "N/A" | .[0:10])
Version Info :
\(get_versions)
Description  : \(.containers.cna.descriptions[0].value | gsub("[\n\t\r]+"; " "))"
                ' 2>/dev/null)
            fi

            if [ -n "$OUT" ]; then
                echo "$OUT" | fold -s -w 100
                echo "--------------------------------------------------------------------------------"
            fi
        fi
        sleep 0.2
    done
}

# ==============================================================================
# FUNCTION: Monitor & Alerting (Mode: monitor)
# ==============================================================================
run_monitor() {
    echo "Running Monitor Mode..."
    CURRENT_STATE=$(OUTPUT="csv" run_search "true")

    if [ ! -f "$MONITOR_FILE" ]; then
        echo "No previous state found. Creating baseline at $MONITOR_FILE..."
        echo "$CURRENT_STATE" > "$MONITOR_FILE"
        exit 0
    fi

    NEW_CVES=$(echo "$CURRENT_STATE" | grep -F -x -v -f "$MONITOR_FILE")

    if [ -n "$NEW_CVES" ] && [ "$NEW_CVES" != '"CVE_ID","Title","CVSS","Vector","Published","Description"' ]; then
        echo "⚠️ ALERT: New or updated Yugabyte CVEs detected!"
        echo "$NEW_CVES"
        echo "$CURRENT_STATE" > "$MONITOR_FILE"
    else
        echo "No new CVEs detected since last run."
    fi
}

# ==============================================================================
# MAIN ROUTING
# ==============================================================================
case $MODE in
    search) run_search "false" ;;
    supply) run_supply_chain ;;
    lookup) run_lookup ;;
    monitor) run_monitor ;;
    *) echo "Invalid mode. Use -h for help."; exit 1 ;;
esac