Fix Wazuh 4.8 parser to attach endpoints/locations to findings

[DeWaRs1206]

Summary

The Wazuh 4.8 parser currently creates findings without associating them with an Endpoint/Location, unlike the 4.7 parser.

This change updates the Wazuh 4.8 parser to attach the agent name to each finding:

• as a Location when V3_FEATURE_LOCATIONS is enabled
• as an Endpoint otherwise

This restores host association for imported Wazuh 4.8 findings and keeps the behavior aligned with the existing feature flag logic.

I also added the missing cvssv3_score mapping from the Wazuh score payload.
Tests were added to validate the expected behavior.

[valentijnscholten]

Could you also rephrase the title + description as it doesn't really reflect the issue/fix at the moment

[dryrunsecurity]

This pull request introduces code that constructs Endpoint/Location objects using unvalidated external input (agent name) in dojo/tools/wazuh/v4_8.py (lines 62–67), which could allow server-side request forgery (SSRF) if attacker-controlled values are used to issue requests or render URLs. The finding is marked critical and should be mitigated by validating/normalizing the agent input, enforcing scheme/host allowlists, or otherwise sanitizing/isolating usage before any network calls.

🔴 Potential Server-Side Request Forgery (SSRF) in dojo/tools/wazuh/v4_8.py (drs_fa8304ff)

Vulnerability	Potential Server-Side Request Forgery (SSRF)
Description	Unvalidated external input used to construct Endpoint/Location objects. The code assigns item.get("agent").get("name") directly into LocationData.url(host=...) or Endpoint(host=...), without any normalization, scheme or allowlist checks. If agent_name is attacker-controlled and these objects are later used to issue HTTP requests or render external URLs, this can enable SSRF.

django-DefectDojo/dojo/tools/wazuh/v4_8.py

Lines 62 to 67 in 69a25ab

	agent_name = item.get("agent").get("name")
	if agent_name is not None:
	if settings.V3_FEATURE_LOCATIONS:
	find.unsaved_locations = [LocationData.url(host=agent_name)]
	else:
	find.unsaved_endpoints = [Endpoint(host=agent_name)]

---

Comment to provide feedback on these findings.

Report false positive: @dryrunsecurity fp [FINDING ID] [FEEDBACK]
Report low-impact: @dryrunsecurity nit [FINDING ID] [FEEDBACK]

Example: @dryrunsecurity fp drs_90eda195 This code is not user-facing

All finding details can be found in the DryRun Security Dashboard.

[Maffooch]

Unique ID from tool is used as dedupe here, so description field change is fin