Aviatrix Controllers < 7.1.4191 / 7.2 < 7.2.4996 RCE

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(271262);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/24");

  script_cve_id("CVE-2024-50603");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/02/06");

  script_name(english:"Aviatrix Controllers < 7.1.4191 / 7.2 < 7.2.4996 RCE");

  script_set_attribute(attribute:"synopsis", value:
"Aviatrix Controllers are affected by an RCE vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Aviatrix Controller installed on the remote host is prior to 7.1.4191 (for 7.1.x) or prior to 
7.2.4996 (for 7.2.x). It is, therefore, affected by an OS command injection vulnerability caused by improper 
neutralization of special elements in API input. An unauthenticated attacker can send shell metacharacters 
in the cloud_type parameter to /v1/api for list_flightpath_destination_instances, or in src_cloud_type for 
flightpath_connection_test, which may allow arbitrary command or code execution on the controller.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://docs.aviatrix.com/documentation/latest/release-notices/psirt-advisories/psirt-advisories.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?037a8a7f");
  script_set_attribute(attribute:"solution", value:
"Upgrade Aviatrix Controller to version 7.1.4191, 7.2.4996 or later.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-50603");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/01/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/01/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/23");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:aviatrix:controller");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("aviatrix_network_controller_nix_installed.nbin");
  script_require_keys("Host/local_checks_enabled", "installed_sw/Aviatrix Cloud Network Controller");
  script_exclude_keys("Host/MacOSX/Version");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Aviatrix Cloud Network Controller', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        { 'min_version' : '0.0.0', 'fixed_version' : '7.1.4191'},
        { 'min_version' : '7.2.0', 'fixed_version' : '7.2.4996'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);