Security-Tools-Alliance / rengine-ng

reNgine-ng is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface.
GNU General Public License v3.0
19 stars 8 forks source link

bug(ui): Fetch GPT Vulnerability Details always blank dates on high & critical vulns #12

Open psyray opened 4 months ago

psyray commented 4 months ago

Is there an existing issue for this?

Current Behavior

Submitted bu @carboncrystal

  1. I have OpenAI API Key & Netlas API Key set in Rengine.

  2. At OpenAI I have premium API plan and sufficient credits, at Netlas I have plan with 2000 API calls/month.

  3. At Subdomains menu (for example: https://127.0.0.1/scan/myprojectname/detail/15#subdomain-tab) > clicking on Eye Icon (Show Attack Surface) everything works perfectly, you get data (Attack Surface recommendations).

  4. But on the Vulnerabilities menu (e.g. https://127.0.0.1/scan/myprojectname/detail/15#vulnerabilities-tab) > click on 3 dots (...), under the menu in the Action table and selecting Fetch GPT Vulnerability Details, you GET ALWAYS BLANK RESULTS.

Whether Critical, High, Medium, Low, Info, Unknown vulnerabilities are identified in Rengine, you always get the same result: EMPTY BLANK DATES when Fetch GPT Vulnerability Details!

Screenshots

Screenshot from 2024-01-02 09-24-01

Screenshot from 2024-01-02 09-24-38

Expected Behavior

Fetch GPT Vulnerability Details to get data from the OpenAI GPT API.

Steps To Reproduce

Specified above!

Environment

- reNgine: 2.0.2
- OS: Ubuntu 22.04.3 LTS
- Python: Python 3.10.12
- Docker Engine: latest for Ubuntu
- Docker Compose: latest for Ubuntu
- Browser: Firefox, Chrome

Anything else?

No response

psyray commented 4 months ago

Submitted by @Ondjultomte

I experience the same

Vulnerability detail for GeoServer OGC Filter - SQL Injection

Description null

Impact null

Remediation null

References

openAI reports no usage of the API.

running a new install or 2.0.3

I can add that after alittle more testing it only happends on critical and high vulns, not medium. medium and info works just fine to get text from chatgpt. its only critical and high that doesnt wortk for me.