Aviatrix Controller Unrestricted Upload of File (CVE-2021-40870)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(271965);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/30");

  script_cve_id("CVE-2021-40870");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2022/02/01");

  script_name(english:"Aviatrix Controller Unrestricted Upload of File (CVE-2021-40870)");

  script_set_attribute(attribute:"synopsis", value:
"An issue was discovered in Aviatrix Controller.");
  script_set_attribute(attribute:"description", value:
"While the Aviatrix UI requires authentication, many API calls do not enforce a check for authentication. 
Some of these API calls allow an unauthenticated attacker to upload arbitrary files, including .php scripts, 
to the filesystem. These uploaded scripts will be processed by the web frontend, allowing an attacker to run 
code of their choosing.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://wearetradecraft.com/advisories/tc-2021-0002/");
  script_set_attribute(attribute:"solution", value:
"Upgrade viatrix Controller to version 6.2-1804.2043, 6.3-1804.2490, 6.4-1804.2838 or 6.5-1804.1922 or later");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-40870");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/09/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2021/09/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/29");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:aviatrix:controller");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("aviatrix_network_controller_nix_installed.nbin");
  script_require_keys("Host/local_checks_enabled", "installed_sw/Aviatrix Cloud Network Controller");
  script_exclude_keys("Host/MacOSX/Version");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Aviatrix Cloud Network Controller', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        { 'min_version' : '6.2.0', 'fixed_version' : '6.2.2043'},
        { 'min_version' : '6.3.0', 'fixed_version' : '6.3.2490'},
        { 'min_version' : '6.4.0', 'fixed_version' : '6.4.2838'},
        { 'min_version' : '6.5.0', 'fixed_version' : '6.5.1922'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);