Array Networks ArrayOS <= 9.4.0.481 RCE (CVE-2023-28461)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(269978);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/11");

  script_cve_id("CVE-2023-28461");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2024/12/16");

  script_name(english:"Array Networks ArrayOS <= 9.4.0.481 RCE (CVE-2023-28461)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Array Networks device is affected by a remote code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Array Networks ArrayOS running on the remote device is 9.4.0.481 or prior. It is, therefore,
affected by a remote code execution vulnerability. Unauthenticated attackers could execute remote code by
exploiting a specific attribute in an HTTP header, enabling them to browse the filesystem on the device.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://support.arraynetworks.net/prx/001/http/supportportal.arraynetworks.net/documentation/FieldNotice/Array_Networks_Security_Advisory_for_Remote_Code_Execution_Vulnerability_AG.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b073b71d");
  script_set_attribute(attribute:"solution", value:
"Update ArrayOS to version 9.4.0.484 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-28461");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/03/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/03/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/10");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:arraynetworks:arrayos_ag");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/ArrayOS");

  exit(0);
}

include('vcf.inc');
include('os_install.inc');
include('hardware_registration.inc');

get_kb_item_or_exit('Host/ArrayOS');

# get the model
var hw_info = get_hardware(vendor:'Array Networks', category:'secure_access_gateway');
var model = hw_info.product;

# if the model wasn't found, the model defaults to 'unknown'
if (model == 'unknown')
{
  # but the device might still be vulnerable, so continue if paranoid
  if (report_paranoia < 2)
    audit(AUDIT_POTENTIAL_VULN);
} 
# if we found a model and it's not Array AG or Array vxAG, then it's not vuln
else if (model !~ "Array\s*(vx)?AG")
  audit(AUDIT_DEVICE_NOT_VULN, model);

# get the OS install
var os_info = get_os(vendor:'Array Networks', os_name:'ArrayOS');
os_info.app = os_info.os_name;
os_info.parsed_version = vcf::parse_version(os_info.version);

var constraints = [{'max_version': '9.4.0.481', 'fixed_version': '9.4.0.484'}];

vcf::check_version_and_report(app_info:os_info, constraints:constraints, severity:SECURITY_HOLE);