feat: allow different cisa url to be provided (#31728)

Summary

• Allow custom CISA vulnerability data source URL to work around blocked
requests
  • Updates vulnerability sync logic to use configurable CISA endpoint
• Enables organizations to use CISA mirrors when direct access is
blocked

## Testing

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

server/config/config.go

@@ -541,6 +541,7 @@ type VulnerabilitiesConfig struct {
 	CPEDatabaseURL              string        `json:"cpe_database_url" yaml:"cpe_database_url"`
 	CPETranslationsURL          string        `json:"cpe_translations_url" yaml:"cpe_translations_url"`
 	CVEFeedPrefixURL            string        `json:"cve_feed_prefix_url" yaml:"cve_feed_prefix_url"`
+	CISAKnownExploitsURL        string        `json:"cisa_known_exploits_url" yaml:"cisa_known_exploits_url"`
 	CurrentInstanceChecks       string        `json:"current_instance_checks" yaml:"current_instance_checks"`
 	DisableSchedule             bool          `json:"disable_schedule" yaml:"disable_schedule"`
 	DisableDataSync             bool          `json:"disable_data_sync" yaml:"disable_data_sync"`
@@ -1366,6 +1367,8 @@ func (man Manager) addConfigs() {
 		"URL from which to get the latest CPE translations. If empty, it will be downloaded from the latest release available at https://github.com/fleetdm/nvd/releases.")
 	man.addConfigString("vulnerabilities.cve_feed_prefix_url", "",
 		"Prefix URL for the CVE data feed. If empty, default to https://nvd.nist.gov/")
+	man.addConfigString("vulnerabilities.cisa_known_exploits_url", "",
+		"URL from which to get the latest CISA (Known exploited vulnerabilities) database. If empty, it will be downloaded from https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json")
 	man.addConfigString("vulnerabilities.current_instance_checks", "auto",
 		"Allows to manually select an instance to do the vulnerability processing.")
 	man.addConfigBool("vulnerabilities.disable_schedule", false,
@@ -1671,6 +1674,7 @@ func (man Manager) LoadConfig() FleetConfig {
 			CPEDatabaseURL:              man.getConfigString("vulnerabilities.cpe_database_url"),
 			CPETranslationsURL:          man.getConfigString("vulnerabilities.cpe_translations_url"),
 			CVEFeedPrefixURL:            man.getConfigString("vulnerabilities.cve_feed_prefix_url"),
+			CISAKnownExploitsURL:        man.getConfigString("vulnerabilities.cisa_known_exploits_url"),
 			CurrentInstanceChecks:       man.getConfigString("vulnerabilities.current_instance_checks"),
 			DisableSchedule:             man.getConfigBool("vulnerabilities.disable_schedule"),
 			DisableDataSync:             man.getConfigBool("vulnerabilities.disable_data_sync"),

server/vulnerabilities/nvd/sync.go

@@ -26,11 +26,12 @@ import (
 )
 
 type SyncOptions struct {
-	VulnPath           string
-	CPEDBURL           string
-	CPETranslationsURL string
-	CVEFeedPrefixURL   string
-	Debug              bool
+	VulnPath             string
+	CPEDBURL             string
+	CPETranslationsURL   string
+	CVEFeedPrefixURL     string
+	CISAKnownExploitsURL string
+	Debug                bool
 }
 
 // Sync downloads all the vulnerability data sources.
@@ -58,7 +59,7 @@ func Sync(opts SyncOptions, logger log.Logger) error {
 		return fmt.Errorf("sync EPSS CVE feed: %w", err)
 	}
 
-	if err := DownloadCISAKnownExploitsFeed(opts.VulnPath); err != nil {
+	if err := DownloadCISAKnownExploitsFeed(opts.VulnPath, opts.CISAKnownExploitsURL); err != nil {
 		return fmt.Errorf("sync CISA known exploits feed: %w", err)
 	}
 
@@ -141,8 +142,8 @@ func parseEPSSScoresFile(path string) ([]epssScore, error) {
 }
 
 const (
-	cisaKnownExploitsURL      = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
-	cisaKnownExploitsFilename = "known_exploited_vulnerabilities.json"
+	defaultCisaKnownExploitsURL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
+	cisaKnownExploitsFilename   = "known_exploited_vulnerabilities.json"
 )
 
 // knownExploitedVulnerabilitiesCatalog represents the CISA Catalog of Known Exploited Vulnerabilities.
@@ -168,9 +169,13 @@ type knownExploitedVulnerability struct {
 }
 
 // DownloadCISAKnownExploitsFeed downloads the CISA known exploited vulnerabilities feed.
-func DownloadCISAKnownExploitsFeed(vulnPath string) error {
+func DownloadCISAKnownExploitsFeed(vulnPath string, cisaKnownExploitsURL string) error {
 	path := filepath.Join(vulnPath, cisaKnownExploitsFilename)
 
+	if cisaKnownExploitsURL == "" {
+		cisaKnownExploitsURL = defaultCisaKnownExploitsURL
+	}
+
 	u, err := url.Parse(cisaKnownExploitsURL)
 	if err != nil {
 		return err

server/vulnerabilities/nvd/sync_test.go

@@ -32,7 +32,18 @@ func TestDownloadCISAKnownExploitsFeed(t *testing.T) {
 
 	tempDir := t.TempDir()
 
-	err := DownloadCISAKnownExploitsFeed(tempDir)
+	err := DownloadCISAKnownExploitsFeed(tempDir, "")
+	require.NoError(t, err)
+
+	assert.FileExists(t, filepath.Join(tempDir, cisaKnownExploitsFilename))
+}
+
+func TestDownloadCISAKnownExploitsFeedMirror(t *testing.T) {
+	nettest.Run(t)
+
+	tempDir := t.TempDir()
+
+	err := DownloadCISAKnownExploitsFeed(tempDir, "https://raw.githubusercontent.com/EugenMayer/cisa-known-exploited-mirror/main/known_exploited_vulnerabilities.json")
 	require.NoError(t, err)
 
 	assert.FileExists(t, filepath.Join(tempDir, cisaKnownExploitsFilename))