Apache CXF < 3.6.8 / 4.x < 4.0.9 / 4.1.x < 4.1.3 RCE (CVE-2025-48913)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(249322);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/08/15");

  script_cve_id("CVE-2025-48913");
  script_xref(name:"IAVB", value:"2025-B-0134");

  script_name(english:"Apache CXF < 3.6.8 / 4.x < 4.0.9 / 4.1.x < 4.1.3 RCE (CVE-2025-48913)");

  script_set_attribute(attribute:"synopsis", value:
"Apache CXF is affected by a remote code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Apache CXF installed on the remote host is affected by remote code execution vulnerability. If 
untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially 
leading to code execution capabilities. This interface is now restricted to reject those protocols, removing this 
possibility.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://lists.apache.org/thread/f1nv488ztc0js4g5ml2v88mzkzslyh83
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c24d70f9");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache CXF version 3.6.8, 4.0.9, or 4.1.3 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-48913");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/08/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/08/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/08/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:cxf");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("apache_cxf_detect.nbin");
  script_require_keys("installed_sw/Apache CXF");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Apache CXF', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        { 'fixed_version':'3.6.8'},
        { 'min_version':'4.0', 'fixed_version':'4.0.9'},
        { 'min_version':'4.1', 'fixed_version':'4.1.3'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);