Script to download the National Vulnerability Database files from https://nvd.nist.gov

nvd_download.sh

#!/bin/sh
 
# https://gist.github.com/christiangalsterer/5f55389b9c50c74c31b9
 
# Copyright 2015 Christian Galsterer
#
#  Licensed under the Apache License, Version 2.0 (the "License");
#  you may not use this file except in compliance with the License.
#  You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
#  Unless required by applicable law or agreed to in writing, software
#  distributed under the License is distributed on an "AS IS" BASIS,
#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#  See the License for the specific language governing permissions and
#  limitations under the License.
 
# Downloads the National Vulnerability Database files from https://nvd.nist.gov
# If no parameter is specified the files will be downloaded to the current directory. Alternativly a target directory can be specified as an argument to the script.
 
# export https_proxy=<ADD HERE YOUR PROXY IF NEEDED>
 
START_YEAR=2002
END_YEAR=$(date +'%Y')
DOWNLOAD_DIR=.
 
CVE_12_MODIFIED_URL='https://nvd.nist.gov/download/nvdcve-Modified.xml.gz'
CVE_20_MODIFIED_URL='https://nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-Modified.xml.gz'
CVE_12_BASE_URL='https://nvd.nist.gov/download/nvdcve-%d.xml.gz'
CVE_20_BASE_URL='https://nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-%d.xml.gz'
 
if [[ $# -eq 1 ]] ; then
    DOWNLOAD_DIR=$1
fi
 
START_TIME=$(date +%s)
 
download () {
    echo
    echo "Starting download of $1"
    OUTPUT_FILE=${1##*/}
    wget --no-check-certificate $1 -P $DOWNLOAD_DIR -O $OUTPUT_FILE
    if [ "$?" != 0 ]; then
        echo "ERROR: Downloading of $1 failed."
        exit 1
    fi
    
    echo "Extracting $OUTPUT_FILE" 
    gzip -df $OUTPUT_FILE
    
    if [ "$?" != 0 ]; then
        echo "ERROR: Extracting of $OUTPUT_FILE failed."
        exit 1
    fi
    
    echo "Download of $1 sucessfully completed."
    echo
}
 
echo "Starting download of NVD files ..."
download "$CVE_12_MODIFIED_URL"
download "$CVE_20_MODIFIED_URL"
 
for ((i=$START_YEAR;i<=$END_YEAR;i++));
do
    download "${CVE_12_BASE_URL//%d/$i}" 
    
done
 
for ((i=$START_YEAR;i<=$END_YEAR;i++));
do
    download "${CVE_20_BASE_URL//%d/$i}"
done
 
END_TIME=$(date +%s)
DURATION=$((END_TIME-START_TIME))
echo "Download of NVD files successfully completed in $DURATION seconds."

This functionality will be deprecated in September 2023.

Until then, it is still possible to grab a backup of the NVD files with

for y in {2002..2023}; do curl -LO "https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-$y.json.gz"; done

This functionality will be deprecated in September 2023.

Until then, it is still possible to grab a backup of the NVD files with

for y in {2002..2023}; do curl -LO "https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-$y.json.gz"; done

That was a very clever and simple solution. Thank you.

I'll add that for anyone seeking to ingest this in another platform, you can unwrap the compressed json with the same approach, by replacing curl with gunzip.

I used parallel to optimize, albeit it wasn't really necessary.
parallel --progress gunzip ::: nvdcve-1.1-{2002..2023}.json.gz

Then be aware that there is a header on the actual cve data, so the structure is like this for each file:

{
  "CVE_data_type" : "CVE",
  "CVE_data_format" : "MITRE",
  "CVE_data_version" : "4.0",
  "CVE_data_numberOfCVEs" : "6769",
  "CVE_data_timestamp" : "2023-08-17T07:02Z",
  "CVE_Items" : [ {... **cve objects** ...} ]
}

Which you can easily pick out with jq if you want to continue with the terminal or in python by iterating each file and picking the objects, and yielding it into whatever you're uploading it to:

    with open(filename, "r") as file:
        return json.load(file).get("CVE_Items", [])

This leaves you with nicely formatted json objects for each cve from the export, to do with as you please.

Good solution but outdated. Do you have any new one?
I tried to make it in 2024 and it seems that the response received from the server is not in the expected JSON format but rather an HTML document.

Do I need any authentication or specific rate limiting?

Thanks for reaching out, but this project is not longer maintained and the old API is not longer supported, see previous comments. You may want to have a look at https://nvd.nist.gov/vuln/data-feeds and create a new solution.

I use an updated script: https://gist.github.com/dougluce/e59109adaf027d1b622039a79921e96f