Apache ZooKeeper 3.8.x < 3.8.8 / 3.9.x < 3.9.7 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(377015);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/11/06");

  script_cve_id(
    "CVE-2026-100235",
    "CVE-2026-100252",
    "CVE-2026-100300"
  );
  script_xref(name:"IAVB", value:"2026-B-0312");

  script_name(english:"Apache ZooKeeper 3.8.x < 3.8.8 / 3.9.x < 3.9.7 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote Apache ZooKeeper server is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Apache ZooKeeper listening on the remote host is 3.8.x prior to 3.8.8 or 3.9.x
prior to 3.9.7. It is, therefore, affected by multiple vulnerabilities:

  - Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the
    setACL request handling of Apache ZooKeeper. When a node's ACL is changed via setACL, the
    pending change is not published to the server's outstanding change record for that node. Any
    request that is prepared (and authorized) after the setACL is submitted but before it commits
    is therefore checked against the previous, pre-revocation ACL, yet is applied to the data tree
    after the ACL change has taken effect. A client that currently holds a permission can use this
    window to perform operations requiring that permission through and after its revocation.
    (CVE-2026-100235)

  - Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled
    on the client port, the server's SASL callback handler grants every authorization identity
    (authzid) that a client requests, without checking it against the principal the client
    authenticated as. An authenticated client whose principal is not covered by the auth_to_local
    rules can therefore claim any SASL identity, and gains the permissions granted to that identity
    in sasl ACLs. If the requested identity matches a configured zookeeper.superUser, it gets
    superuser access to the whole data tree. (CVE-2026-100252)

  - Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an
    attacker able to write under the /zookeeper/quota subtree - unauthenticated on default
    deployments, where that subtree is world-writable - to crash the server's critical
    request-processing thread and render the on-disk data directory permanently unbootable.
    (CVE-2026-100300)

Note that Nessus has not tested for these issues but has instead relied only on the application's
self-reported version number.");
  script_set_attribute(attribute:"see_also", value:"https://www.openwall.com/lists/oss-security/2026/11/03/9");
  script_set_attribute(attribute:"see_also", value:"https://www.openwall.com/lists/oss-security/2026/11/03/10");
  script_set_attribute(attribute:"see_also", value:"https://www.openwall.com/lists/oss-security/2026/11/03/11");
  script_set_attribute(attribute:"solution", value:
"Update to Apache ZooKeeper 3.8.8 or 3.9.7 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-100252");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-100300");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/11/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/11/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/11/06");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:zookeeper");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("apache_zookeeper_detect.nbin");
  script_require_keys("installed_sw/Apache Zookeeper");
  script_require_ports("Services/zookeeper", 2181);

  exit(0);
}

include("vcf.inc");

var port = get_service(svc:"zookeeper", default:2181, exit_on_fail:TRUE);
var app_info = vcf::get_app_info(app:"Apache Zookeeper", port:port, service:TRUE);

var constraints = [
  { 'min_version' : '3.8.0', 'fixed_version' : '3.8.8' },
  { 'min_version' : '3.9.0', 'fixed_version' : '3.9.7' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);