Parse NVD XML with PHP - php

Question

I am trying to parse this XML file: http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-modified.xml
<?xml version='1.0' encoding='UTF-8'?>
<nvd xmlns:cvss="http://scap.nist.gov/schema/cvss-v2/0.2" xmlns="http://scap.nist.gov/schema/feed/vulnerability/2.0" xmlns:vuln="http://scap.nist.gov/schema/vulnerability/0.4" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/0.1" xmlns:cpe-lang="http://cpe.mitre.org/language/2.0" xmlns:patch="http://scap.nist.gov/schema/patch/0.1" nvd_xml_version="2.0" pub_date="2013-07-11T12:00:45" xsi:schemaLocation="http://scap.nist.gov/schema/patch/0.1 http://nvd.nist.gov/schema/patch_0.1.xsd http://scap.nist.gov/schema/scap-core/0.1 http://nvd.nist.gov/schema/scap-core_0.1.xsd http://scap.nist.gov/schema/feed/vulnerability/2.0 http://nvd.nist.gov/schema/nvd-cve-feed_2.0.xsd">
<entry id="CVE-2000-0851">
<vuln:vulnerable-configuration id="http://nvd.nist.gov/">
<cpe-lang:logical-test negate="false" operator="OR">
<cpe-lang:fact-ref name="cpe:/o:microsoft:windows_2000"/>
</cpe-lang:logical-test>
</vuln:vulnerable-configuration>
<vuln:vulnerable-software-list>
<vuln:product>cpe:/o:microsoft:windows_2000</vuln:product>
</vuln:vulnerable-software-list>
<vuln:cve-id>CVE-2000-0851</vuln:cve-id>
<vuln:published-datetime>2000-11-14T00:00:00.000-05:00</vuln:published-datetime>
<vuln:last-modified-datetime>2013-07-06T00:11:34.357-04:00</vuln:last-modified-datetime>
<vuln:cvss>
<cvss:base_metrics upgraded-from-version="1.0">
<cvss:score>4.6</cvss:score>
<cvss:access-vector>LOCAL</cvss:access-vector>
<cvss:access-complexity>LOW</cvss:access-complexity>
<cvss:authentication>NONE</cvss:authentication>
<cvss:confidentiality-impact>PARTIAL</cvss:confidentiality-impact>
<cvss:integrity-impact>PARTIAL</cvss:integrity-impact>
<cvss:availability-impact>PARTIAL</cvss:availability-impact>
<cvss:source>http://nvd.nist.gov</cvss:source>
<cvss:generated-on-datetime>2004-01-01T00:00:00.000-05:00</cvss:generated-on-datetime>
</cvss:base_metrics>
</vuln:cvss>
<vuln:security-protection>ALLOWS_OTHER_ACCESS</vuln:security-protection>
<vuln:references xml:lang="en" reference_type="VENDOR_ADVISORY">
<vuln:source>BID</vuln:source>
<vuln:reference href="http://www.securityfocus.com/bid/1651" xml:lang="en">1651</vuln:reference>
</vuln:references>
<vuln:references xml:lang="en" reference_type="UNKNOWN">
<vuln:source>MS</vuln:source>
<vuln:reference href="http://www.microsoft.com/technet/security/bulletin/ms00-065.asp" xml:lang="en">MS00-065</vuln:reference>
</vuln:references>
<vuln:references xml:lang="en" reference_type="UNKNOWN">
<vuln:source>ATSTAKE</vuln:source>
<vuln:reference href="http://www.atstake.com/research/advisories/2000/a090700-1.txt" xml:lang="en">A090700-1</vuln:reference>
</vuln:references>
<vuln:references xml:lang="en" reference_type="UNKNOWN">
<vuln:source>XF</vuln:source>
<vuln:reference href="http://xforce.iss.net/static/5203.php" xml:lang="en">w2k-still-image-service</vuln:reference>
</vuln:references>
<vuln:summary>Buffer overflow in the Still Image Service in Windows 2000 allows local users to gain additional privileges via a long WM_USER message, aka the "Still Image Service Privilege Escalation" vulnerability.</vuln:summary>
</entry>
<entry id="CVE-2004-0685">
...
I do the following
$url = 'http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-modified.xml';
$source = file_get_contents($url);
$xml = new SimpleXMLElement($source);
If I echo the $source, then I see that the whole XML file has been loaded, but if I print_r $xml, only the id's are echo-ed:
SimpleXMLElement Object
(
[#attributes] => Array
(
[nvd_xml_version] => 2.0
[pub_date] => 2013-07-11T12:00:45
)
[entry] => Array
(
[0] => SimpleXMLElement Object
(
[#attributes] => Array
(
[id] => CVE-2000-0851
)
)
[1] => SimpleXMLElement Object
(
[#attributes] => Array
(
[id] => CVE-2004-0685
)
)
Why am I missing all the information in the "entry" tags

Answer 1

Maybe this could get you started:
<?php
$url = 'http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-modified.xml';
$source = file_get_contents($url);
$xml = new SimpleXMLElement($source);
$entries = $xml->entry;
foreach ($entries as $entry) {
$namespace = $entry->getNameSpaces(true);
$tmp = $entry->children($namespace['vuln']);
//print_r($namespace);
print_r($tmp);
break;
}
Outputs:
SimpleXMLElement Object
(
[vulnerable-configuration] => SimpleXMLElement Object
(
)
[vulnerable-software-list] => SimpleXMLElement Object
(
[product] => cpe:/o:microsoft:windows_2000
)
[cve-id] => CVE-2000-0851
[published-datetime] => 2000-11-14T00:00:00.000-05:00
[last-modified-datetime] => 2013-07-06T00:11:34.357-04:00
[cvss] => SimpleXMLElement Object
(
)
[security-protection] => ALLOWS_OTHER_ACCESS
[references] => Array
(
[0] => SimpleXMLElement Object
(
[source] => BID
[reference] => 1651
)
[1] => SimpleXMLElement Object
(
[source] => MS
[reference] => MS00-065
)
[2] => SimpleXMLElement Object
(
[source] => ATSTAKE
[reference] => A090700-1
)
[3] => SimpleXMLElement Object
(
[source] => XF
[reference] => w2k-still-image-service
)
)
[summary] => Buffer overflow in the Still Image Service in Windows 2000 allows local users to gain additional privileges via a long WM_USER message, aka the "Still Image Service Privilege Escalation" vulnerability.
)
You can un-comment print_r($namespace), to see what the custom namespaces include.
If I do print out $namespace, the output is:
Array
(
[] => http://scap.nist.gov/schema/feed/vulnerability/2.0
[vuln] => http://scap.nist.gov/schema/vulnerability/0.4
[cpe-lang] => http://cpe.mitre.org/language/2.0
[cvss] => http://scap.nist.gov/schema/cvss-v2/0.2
[xml] => http://www.w3.org/XML/1998/namespace
)
Then to get vulnerable-configuration's attributes, simply use ->getAttribute('name')
An example of this would be:
print_r($tmp->{"vulnerable-configuration"}->attributes());
You should place the name in {} because it includes an invalid character.
The above should print out:
SimpleXMLElement Object
(
[#attributes] => Array
(
[id] => http://nvd.nist.gov/
)
)
If you don't know the values before hand, you can still loop through the $namespace variable:
foreach ($namespaces as $namespace) {
$tmp = $entry->children($namespace);
print_r($tmp);
}
The output of this would be:
SimpleXMLElement Object
(
)
SimpleXMLElement Object
(
[vulnerable-configuration] => SimpleXMLElement Object
(
)
[vulnerable-software-list] => SimpleXMLElement Object
(
[product] => cpe:/o:microsoft:windows_2000
)
[cve-id] => CVE-2000-0851
[published-datetime] => 2000-11-14T00:00:00.000-05:00
[last-modified-datetime] => 2013-07-06T00:11:34.357-04:00
[cvss] => SimpleXMLElement Object
(
)
[security-protection] => ALLOWS_OTHER_ACCESS
[references] => Array
(
[0] => SimpleXMLElement Object
(
[source] => BID
[reference] => 1651
)
[1] => SimpleXMLElement Object
(
[source] => MS
[reference] => MS00-065
)
[2] => SimpleXMLElement Object
(
[source] => ATSTAKE
[reference] => A090700-1
)
[3] => SimpleXMLElement Object
(
[source] => XF
[reference] => w2k-still-image-service
)
)
[summary] => Buffer overflow in the Still Image Service in Windows 2000 allows local users to gain additional privileges via a long WM_USER message, aka the "Still Image Service Privilege Escalation" vulnerability.
)
SimpleXMLElement Object
(
)
SimpleXMLElement Object
(
)
SimpleXMLElement Object
(
)