actionmailer Ruby Library 3.x < 6.1.7.9 / 7.0.x < 7.0.8.5 / 7.1.x < 7.1.4.1 / 7.2.x < 7.2.1.1 DoS (CVE-2024-47889)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(209307);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/23");

  script_cve_id("CVE-2024-47889");
  script_xref(name:"IAVB", value:"2024-B-0157");

  script_name(english:"actionmailer Ruby Library 3.x < 6.1.7.9 / 7.0.x < 7.0.8.5 / 7.1.x < 7.1.4.1 / 7.2.x < 7.2.1.1 DoS (CVE-2024-47889)");

  script_set_attribute(attribute:"synopsis", value:
"A Ruby library installed on the remote host is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of the actionmailer Ruby library installed on the remote host is 3.x prior to 6.1.7.9, 7.0.x prior to 
7.0.8.5, 7.1.x prior to 7.1.4.1 or 7.2.x prior to 7.2.1.1. It is, therefore, affected by a denial of service (DoS)
vulnerability. The vulnerability lies in the block_format helper of Action Mailer. Carefully crafted text can cause the
block_format helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running
an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch
immediately. As a workaround, users can avoid calling the `block_format` helper or upgrade to Ruby 3.2. Ruby 3.2 has
mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 requires
Ruby 3.2 or greater so is unaffected.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/rails/rails/security/advisories/GHSA-h47h-mwp9-c6q6");
  script_set_attribute(attribute:"solution", value:
"Upgrade to actionmailer version 6.1.7.9, 7.0.8.5, 7.1.4.1, 7.2.1.1 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-47889");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/10/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/10/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/10/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ruby:actionmailer");
  script_set_attribute(attribute:"stig_severity", value:"III");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2024-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ruby_modules_nix_installed.nbin", "ruby_gem_modules_macos_installed.nbin", "ruby_modules_win_installed.nbin");
  script_require_keys("Host/ruby/modules/enumerated");

  exit(0);
}

include('ruby.inc');

var gem_name = 'actionmailer';
var app_info = ruby_gems::get_app_info(app:gem_name);
if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, gem_name);

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  {'min_version': '3.0', 'fixed_version': '6.1.7.9'},
  {'min_version': '7.0', 'fixed_version': '7.0.8.5'},
  {'min_version': '7.1', 'fixed_version': '7.1.4.1'},
  {'min_version': '7.2', 'fixed_version': '7.2.1.1'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);