Apache Commons FileUpload < 1.6 , 2.0.0-M1 < 2.0.0-M4 Denial of Service (CVE-2025-48976)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(278764);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/24");

  script_cve_id("CVE-2025-48976");

  script_name(english:"Apache Commons FileUpload < 1.6 , 2.0.0-M1 < 2.0.0-M4 Denial of Service (CVE-2025-48976)");

  script_set_attribute(attribute:"synopsis", value:
"A package installed on the remote host is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Apache Commons FileUpload on the remote host is < 1.6 , 2.0.0-M1 < 2.0.0-M4. It is, therefore, 
affected by a denial of service vulnerability due to allocation of resources for multipart headers with 
insufficient limits. 

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"http://openwall.com/lists/oss-security/2025/06/16/4");
  script_set_attribute(attribute:"see_also", value:"https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache Commons FileUpload 1.6 , 2.0.0-M4 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-48976");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/06/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/16");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:commons_fileupload");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("apache_commons_fileupload_jar_detect.nbin");
  script_require_keys("installed_sw/Apache Commons FileUpload");

  exit(0);
}

include('vcf.inc');
include('vcf_extras.inc');

var app = 'Apache Commons FileUpload';

vcf::apache_commons_fileupload::initialize();
var app_info = vcf::get_app_info(app:app);


var constraints = [
  { 'min_version' : '1.0',          'fixed_version' : '1.6' },
  { 'min_version' : '2.0.0-M1',     'fixed_version' : '2.0.0-M4' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);