Apache ZooKeeper 3.8.x < 3.8.7 / 3.9.x < 3.9.6 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(347958);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/18");

  script_cve_id(
    "CVE-2026-59739",
    "CVE-2026-59969",
    "CVE-2026-79993",
    "CVE-2026-84439",
    "CVE-2026-84501"
  );

  script_name(english:"Apache ZooKeeper 3.8.x < 3.8.7 / 3.9.x < 3.9.6 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote Apache ZooKeeper server is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Apache ZooKeeper listening on the remote host is 3.8.x prior to 3.8.7 or 3.9.x
prior to 3.9.6. It is, therefore, affected by multiple vulnerabilities:

  - Information disclosure via SetWatches reconnect replay due to a missing ACL check. An attacker
    can discover ACL-restricted paths by registering exists-watches on non-existent paths, then
    reconnecting after the paths are created with restricted ACLs. The SetWatches/SetWatches2
    reconnect replay handler calls watcher.process(event) with null ACL, bypassing the check in
    WatchManager.triggerWatch(). Only the path is exposed, not the znode data, but znode paths
    can contain sensitive information such as usernames or login IDs. (CVE-2026-59739)

  - Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode
    deployments. When sslQuorum=true, zookeeper.fips-mode=true,
    ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are
    enabled, the Java SSLSocket quorum path accepts a CA-trusted peer certificate whose SAN does
    not match the connected host. A malicious or misissued peer certificate can therefore join
    quorum traffic, participate in leader election, and enter replication flows. (CVE-2026-59969)

  - The deleteContainer opcode (0x14/20) is processed without verifying the caller's ACL
    permissions. A client that can open a plain TCP session on the ZooKeeper client port, with no
    authentication and no ACL permissions, can delete any empty persistent znode, including
    regular persistent nodes, container nodes and TTL nodes, by issuing the raw protocol
    deleteContainer opcode. The deleteContainer request path skips both the session check and the
    DELETE ACL check that are enforced by the regular delete path. (CVE-2026-79993)

Note that Nessus has not tested for these issues but has instead relied only on the application's
self-reported version number.");
  script_set_attribute(attribute:"see_also", value:"https://lists.apache.org/thread/ohby1g6zjt72p0w79rhbr41nczzvr33y");
  script_set_attribute(attribute:"see_also", value:"https://lists.apache.org/thread/b7qnjvqjh393l0j07tmnb5ggg40sx3m6");
  script_set_attribute(attribute:"solution", value:
"Update to Apache ZooKeeper 3.8.7 or 3.9.6 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-59739");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/18");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:zookeeper");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("apache_zookeeper_detect.nbin");
  script_require_keys("installed_sw/Apache Zookeeper");
  script_require_ports("Services/zookeeper", 2181);

  exit(0);
}

include("vcf.inc");

var port = get_service(svc:"zookeeper", default:2181, exit_on_fail:TRUE);
var app_info = vcf::get_app_info(app:"Apache Zookeeper", port:port, service:TRUE);

var constraints = [
  { 'min_version' : '3.8.0', 'fixed_version' : '3.8.7' },
  { 'min_version' : '3.9.0', 'fixed_version' : '3.9.6' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);