String comparison from XML failing - powershell

Question

I am currently working on a project in PowerShell. The project downloads the NVD database XML, loops through a separate CSV for scan results from Nexpose, and pulls CVSS scores for each vulnerability identified with a CVE number.
It seems that matching the CVE number from the sheet (string) with the CVE number in the XML (also a string) is failing completely. The code i am using is below:
clear
[xml]$nvdxml = (New-Object system.Net.WebClient).DownloadString("http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-recent.xml")
$nsmgr = New-Object System.XML.XmlNamespaceManager($nvdxml.NameTable)
$nsmgr.AddNamespace('xsi','http://www.w3.org/2001/XMLSchema-instance')
$nsmgr.AddNamespace('vuln','http://scap.nist.gov/schema/vulnerability/0.4')
$nsmgr.AddNamespace('cvss','http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-recent.xml')
$nsmgr.AddNamespace('df','http://scap.nist.gov/schema/feed/vulnerability/2.0')
$nvdxml.SelectNodes('//vuln:product',$nsmgr) | out-null
$nvdxml.SelectNodes('//vuln:vulnerable-configuration',$nsmgr) | out-null
$nvdxml.SelectNodes('//vuln:vulnerable-software-list',$nsmgr) | out-null
$nvdxml.SelectNodes('//default:nvd',$nsmgr) | out-null
$nvdxml.SelectNodes('//default:entry',$nsmgr) | out-null
$x = import-csv "test-report.csv"
$items = #()
$x | where {$_."Vulnerability Test Result Code" -like "v*"} | %{
$item = #{}
$vid = $_."Vulnerability CVE IDs"
$entry = ""
$item["Vname"] = $_."Vulnerability Title"
$item["VNode"] = $_."Asset IP Address"
$item['VID'] = $vid
$entry = $nvdxml.nvd.entry | where { $_."cve-id" -eq $vid }
$item['Score'] = $entry.cvss.base_metrics.score
$items += $item
}
$items
The $items array contains a vulnerability which has a CVE ID, but the string comparison is utterly failing. When I query for the object's type I get
You cannot call a method on a null-valued expression.
At line:25 char:19
+ $entry.GetType <<<< ()
+ CategoryInfo : InvalidOperation: (GetType:String) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull
When I assign a CVE ID to a string, and attempt to get the relevant vulnerability from the XML for that string, the comparison returns no results; yet, when I replace the variable with the quoted string of the same ID, the query returns the correct result. So, this would fail
$cveID = "CVE-2003-1567"
$nvdxml.nvd.entry | where { $_."cve-id" -eq $cveID }
However, this works fine
$nvdxml.nvd.entry | where { $_."cve-id" -eq "CVE-2003-1567" }
Any ideas? I have tried explicitly casting both $_."cve-id" and $cveID as String with the same results.

Answer 1

I would put all the entries in a hashtable, then look it up via the CVE ID:
$entriesByID = #{ }
$nvdxml.nvd.entry |
ForEach-Object { $entriesByID[$_.id] = $_ }
Note that instead of using the cve-id element, I'm using the id attribute on the event element.
Then, you can look it each entry in the hashtable:
$entry = $entriesByID[$vid]
If you're married to your original approach, you may be running into namespace issues. I would try using SelectNodes instead of PowerShell's virtual XML object properties:
$entry = $nvdxml.SelectSingleNode('/nvd/entry[vuln:cve-id = "$vid"]')
# or
$entry = $nvdxml.SelectSingleNode('/nvd/entry[#id = "$vid"]')