Apache ZooKeeper 3.8.x < 3.8.6 / 3.9.x < 3.9.5 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(301976);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/13");

  script_cve_id("CVE-2026-24281", "CVE-2026-24308");
  script_xref(name:"IAVB", value:"2026-B-0062");

  script_name(english:"Apache ZooKeeper 3.8.x < 3.8.6 / 3.9.x < 3.9.5 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote Apache ZooKeeper server is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Apache ZooKeeper listening on the remote host is 3.8.x prior to 3.8.6 or 3.9.x
prior to 3.9.5. It is, therefore, affected by multiple vulnerabilities:

  - Improper handling of configuration values in ZKConfig allows an attacker to expose sensitive
    information stored in client configuration in the client's logfile. Configuration values are
    exposed at INFO level logging, rendering potential production systems affected by the issue.
    (CVE-2026-24308)

  - Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR)
    when IP SAN validation fails, allowing attackers who control or spoof PTR records to
    impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. Note
    that an attacker must present a certificate which is trusted by ZKTrustManager, which makes
    the attack vector harder to exploit. (CVE-2026-24281)

Note that Nessus has not tested for these issues but has instead relied only on the application's
self-reported version number.");
  script_set_attribute(attribute:"see_also", value:"https://lists.apache.org/thread/088ddsbrzhd5lxzbqf5n24yg0mwh9jt2");
  script_set_attribute(attribute:"see_also", value:"https://lists.apache.org/thread/qng3rtzv2pqkmko4rhv85jfplkyrgqdr");
  script_set_attribute(attribute:"solution", value:
"Update to Apache ZooKeeper 3.8.6 or 3.9.5 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-24308");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/12");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:zookeeper");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("apache_zookeeper_detect.nbin");
  script_require_keys("installed_sw/Apache Zookeeper");
  script_require_ports("Services/zookeeper", 2181);

  exit(0);
}

include("vcf.inc");

var port = get_service(svc:"zookeeper", default:2181, exit_on_fail:TRUE);
var app_info = vcf::get_app_info(app:"Apache Zookeeper", port:port, service:TRUE);

var constraints = [
  { 'min_version' : '3.8.0', 'fixed_version' : '3.8.6' },
  { 'min_version' : '3.9.0', 'fixed_version' : '3.9.5' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);