nuclei incorrect deduplication

[egorbeliy]

Bug description Nuclei findings with different Endpoints but same other finding fields (component name, cve, etc) marked as duplicates after being imported

Steps to reproduce Steps to reproduce the behavior:

1. do scan of amazon.com and google.com using nuclei nuclei -list targets.txt -j -s low -o output.json

targets.txt sample of output has been attached

2. import results to defectdojo

curl -s -X POST "$DEFECTDOJO_URL/api/v2/import-scan/" \
  -H "Authorization: Token $DEFECTDOJO_TOKEN" \
  -F "scan_date=$(date +%F)" \
  -F "minimum_severity=Low" \
  -F "scan_type=Nuclei Scan" \
  -F "file=@$NUCLEI_OUTPUT;type=application/json" \
  -F "engagement_name=Passive scan" \
  -F "product_name=Passive scan" \
  -F "verified=false" \
  -F "active=true" \
  -F "auto_create_context=true" \
  -F "auto_create=true" \
  -F "product_type_name=Research and Development" \
  -F "close_old_findings=false" \
  -F "push_to_jira=false"

3. google.com findings are active, amazon.com findings being closed as duplicate

Expected behavior Amazon findings aren't duplicates, 2 findings with 2 endpoints in each should be created

Environment information

• Defectdojo version - v. 2.44.2
• Nuclei version - v3.4.2

[manuel-sommer]

Could you check the PR @egorbeliy ?

[egorbeliy]

i guess looks good