Groktocrawl CVE Adapters (NVD + CVE Program) — structured CVE data extraction from public APIs

cve-adapters-demo.md

Groktocrawl CVE Adapters — structured CVE data from public APIs

Demo against CVE-2024-3094 (xz backdoor), the most critical CVE of 2024.

---

Adapter 1: NVD API (nvd.nist.gov)

The NVD adapter returns enriched data: CVSS scores, CWE classification, tagged references, and CPE matches.

Request: POST /scrape {"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3094"}

data.metadata:

{
  "cve_id": "CVE-2024-3094",
  "published": "2024-03-29",
  "modified": "2025-08-19",
  "severity": "CRITICAL",
  "cvss_v3": 10.0,
  "cvss_v4": null,
  "kev": false,
  "cwe": "CWE-506",
  "source": "nvd-api"
}

data.markdown:

---
cve_id: CVE-2024-3094
published: 2024-03-29
modified: 2025-08-19
severity: CRITICAL
cvss_v3: 10.0
cvss_v4: None
kev: False
cwe: CWE-506
source: nvd-api
---

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. 
Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

## CVSS Scores

| Metric | Value |
|--------|-------|
| CVSS v3.1 Score | **10.0** (CRITICAL) |
| Vector (v3) | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` |
| Exploitability (v3) | 3.9 |

## Weakness Classification

- CWE-506

## Affected Products (CPE)

| CPE Match | Vulnerable | Version Start | Version End |
|---|---|---|---|

## References

| URL | Tags |
|-----|------|
| https://access.redhat.com/security/cve/CVE-2024-3094 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2272210 | Issue Tracking, Vendor Advisory |
| https://www.openwall.com/lists/oss-security/2024/03/29/4 | Mailing List |
| https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users | Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2024/03/29/10 |  |
| http://www.openwall.com/lists/oss-security/2024/03/29/12 |  |
| http://www.openwall.com/lists/oss-security/2024/03/29/4 |  |
| http://www.openwall.com/lists/oss-security/2024/03/29/5 |  |
| http://www.openwall.com/lists/oss-security/2024/03/29/8 |  |
| http://www.openwall.com/lists/oss-security/2024/03/30/12 |  |
| http://www.openwall.com/lists/oss-security/2024/03/30/27 |  |
| http://www.openwall.com/lists/oss-security/2024/03/30/36 |  |
| http://www.openwall.com/lists/oss-security/2024/03/30/5 |  |
| http://www.openwall.com/lists/oss-security/2024/04/16/5 |  |
| https://access.redhat.com/security/cve/CVE-2024-3094 | Vendor Advisory |
| https://ariadne.space/2024/04/02/the-xz-utils-backdoor-is-a-symptom-of-a-larger-problem/ |  |
| https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/ | Third Party Advisory |
| https://aws.amazon.com/security/security-bulletins/AWS-2024-002/ | Third Party Advisory |
| https://blog.netbsd.org/tnf/entry/statement_on_backdoor_in_xz |  |
| https://boehs.org/node/everything-i-know-about-the-xz-backdoor | Third Party Advisory |

---

Adapter 2: CVE Program API (cve.org)

The CVE Program adapter returns the authoritative raw record from the CNA: state tracking, assigner name, vendor-provided affected versions, and credits.

Request: POST /scrape {"url": "https://cve.org/CVERecord?id=CVE-2024-3094"}

data.metadata:

{
  "cve_id": "CVE-2024-3094",
  "state": "PUBLISHED",
  "assigner": "redhat",
  "published": "2024-03-29",
  "title": "Xz: malicious code in distributed source",
  "source": "cve-api"
}

data.markdown:

---
cve_id: CVE-2024-3094
state: PUBLISHED
assigner: redhat
published: 2024-03-29
title: Xz: malicious code in distributed source
source: cve-api
---

# Xz: malicious code in distributed source

**CVE ID:** CVE-2024-3094  
**State:** PUBLISHED  
**Assigner:** redhat  
**Published:** 2024-03-29

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. 
Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

## Affected Products

| Product | Vendor | Versions |
|---------|--------|----------|
|  |  | 5.6.0 (affected); 5.6.1 (affected) |
| Red Hat Enterprise Linux 10 | Red Hat | all |
| Red Hat Enterprise Linux 6 | Red Hat | all |
| Red Hat Enterprise Linux 7 | Red Hat | all |
| Red Hat Enterprise Linux 8 | Red Hat | all |
| Red Hat Enterprise Linux 9 | Red Hat | all |
| Red Hat JBoss Enterprise Application Platform 8 | Red Hat | all |

## Credits

- Unknown

## References

- https://access.redhat.com/security/cve/CVE-2024-3094 (vdb-entry, x_refsource_REDHAT)
- https://bugzilla.redhat.com/show_bug.cgi?id=2272210 (issue-tracking, x_refsource_REDHAT)
- https://www.openwall.com/lists/oss-security/2024/03/29/4
- https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users

---

Bare CVE ID Protocol (cve:CVE-YYYY-NNNNN)

Both adapters accept a bare cve: prefix. The NVD adapter (priority 200) wins first dispatch since it has richer data; if its API rate-limit is exhausted, the CVE Program adapter (priority 150) handles it.

Request: POST /scrape {"url": "cve:CVE-2024-3094"}

Same metadata and markdown as the NVD adapter above (source: nvd-api).

---

Priority Flow

URL Pattern	Adapter	Priority	What it provides
nvd.nist.gov/vuln/detail/CVE-*	nvd.py	200	Enriched — CVSS, CPE, CWE, KEV, tagged refs
cve.org/CVERecord?id=CVE-*	cveorg.py	150	Authoritative raw CNA record
cve.mitre.org/cgi-bin/...	cveorg.py	150	Same authoritative record
cve:CVE-*	Both (NVD wins)	200 > 150	Enriched, falls through to authoritative