Cisco IOS XR Software CLI Arbitrary File Read (cisco-sa-iosxr-shellutil-HCb278wD)

#TRUSTED 2224e2dac6c6ca1403604a1e44637e3afd35f8e0b29d6b7573795f9c99d5f7b1060beaac29047dcee3a404904ce65a8d7652d4d80e36affc097cf3111cec15aa13d21643eced5acd63c44ede9942ff56e485c6dc86ea02c437dcc08a7a332618bcf87ea015232b520b5b4209b1e17a756c52d31ae4a00221f8b74c92dc86e5fa6389862dd276672cf6a25961d9ce493106c1ca5d12bb0a0af57a039be4ee819c2c46b1e9d4bc6a5f356bca0bf017e58f3192b6f563941ac25d4c3acd806056c4a085d34ea8af52a309ee8a252aa87c26f70b321680563d9f0925ac637a8d193a59e316a2676db577fc04eb8b6b338a2de4f094730b3c9da2b10b2d08302da689690c09b210a547692f5e58603519d8fd8d2563d5b04ec9666b1553b4a26f9b124588f39bcc366db00db958e15e03970a7c70c8fcb2544b1e46d9225273b85782145d2dc21993b86653fc2b7f8f9aa41945a914ece849706889484d0c7de75f240672e89559dd62ab19714a4af99cf18ab81dc5d7e4b2124c63fbd71fd8a04b07bfcbcb72ce5018ed0aad82d2ddca92b42e910608507a5184de902fe068d5ebf06a1ac49475b7f340154c81c37f4607b3b4a838bbf2bb53a47c12062227b5765d3db0ea15cb6d331069679538683bb222a6294b81e3143215a1db80607202adf8d898a9aa37a8cae43d8d359e8b2cadd18d4853647b6a2c21a0ebfde3cd113dc9
#TRUST-RSA-SHA256 7fe34a77dc319d37a7603910b998e75d2bba363f14ec258ef64715ea61b4a5150194db1a211f0f8926d7fd3b92ccfba3c85ca6b2ecb6c2f7a9b3436ce5c83222c3d593503046c76416eaf889dcc7cc70c2e07efdf5a85921b5494835246d1cee117665277f13a969042757b6f26c8a875899d39e84c45f327572ee07461504c438e361e30bad35cd9612296668dad201eaecaf4855ecf778e2960bed5e4f75f627588ff8dcacae63a1055518c9d39e71de072f1781fb97541c77ab0820b09d613dc190d496df5bb5855294fef79384faab4945909fe1db849ae1fa4b7cbb3e1e696db53a0a373f124f31bf94990709d1d53c8cce998ed8de031f56ac3f46ebd9f21b71a699f6164800c4b3417a9d743d4f58279c9bbf04d9bfd3405c914ea4273b7b365c1fd904c9051e5ee88ebe645b20f0e43e581566d75bc14a91b1d485d6f7bdca6fb7932c40bdc01ebc75b623c4f2779855610c24dbd3e6afea9d63660f04d65698078c3eb4944c21cc138d4ee3a50d70816c91acbe2739c681e04cc715e4f48594c18ae66fcad73c8bfddf7164d6b591864c4a6501f8037b15adb1289e8c1fa44d55a62f95241a07e0fff0bd30b2043b46fe567500dab519b8c82d587c2c46546e893bdc257754babe3143178533cd21de3ad99849b19a3506cdf08c0986f7c7b0129101dc9aa434b1d8499fc25e0c0c292fae981b1d2b50a5c118c1e4
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(207523);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/07/31");

  script_cve_id("CVE-2024-20343");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwi71881");
  script_xref(name:"CISCO-SA", value:"cisco-sa-iosxr-shellutil-HCb278wD");
  script_xref(name:"IAVA", value:"2024-A-0573-S");

  script_name(english:"Cisco IOS XR Software CLI Arbitrary File Read (cisco-sa-iosxr-shellutil-HCb278wD)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco IOS XR is affected by a vulnerability.

  - A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to read
    any file in the file system of the underlying Linux operating system. The attacker must have valid
    credentials on the affected device. This vulnerability is due to incorrect validation of the arguments
    that are passed to a specific CLI command. An attacker could exploit this vulnerability by logging in to
    an affected device with low-privileged credentials and using the affected command. A successful exploit
    could allow the attacker access files in read-only mode on the Linux file system. (CVE-2024-20343)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iosxr-shellutil-HCb278wD
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e8fe063a");
  # https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75416
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a636b5a5");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwi71881");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwi71881");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-20343");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(284);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/09/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/09/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/09/20");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:ios_xr");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2024-2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ios_xr_version.nasl");
  script_require_keys("Host/Cisco/IOS-XR/Version");

  exit(0);
}

include('ccf.inc');

var product_info = cisco::get_product_info(name:'Cisco IOS XR');

var smus;
var model = toupper(product_info.model);

if ('ASR9K-X64' >< model)
{
  smus['7.3.2'] = 'CSCwk94350';
  smus['7.5.2'] = 'CSCwk94350';
  smus['7.7.2'] = 'CSCwk94350';
  smus['7.8.2'] = 'CSCwk94350';
  smus['7.9.2'] = 'CSCwk94350';
  smus['7.9.21'] = 'CSCwk94350';
  smus['7.10.2'] = 'CSCwk94350';
}

if ('NCS540L' >< model) 
{
  smus['7.5.2'] = 'CSCwk94350';
}

if ('NCS540' >< model) 
{
  smus['7.3.2'] = 'CSCwk94350';
  smus['7.5.2'] = 'CSCwk94350';
  smus['7.8.2'] = 'CSCwk94350';
}

if (preg(string:model, pattern:'NCS-?5500'))
{
  smus['7.3.2'] = 'CSCwk94350';
  smus['7.5.2'] = 'CSCwk94350';
  smus['7.8.2'] = 'CSCwk94350';
  smus['7.9.2'] = 'CSCwk94350';
}

if ('NCS560' >< model) 
{
  smus['7.3.2'] = 'CSCwk94350';
  smus['7.5.2'] = 'CSCwk94350';
  smus['7.10.2'] = 'CSCwk94350';
}

if (model =~ "8[0-9]{3}")
{
  smus['7.5.2'] = 'CSCwk94350';
  smus['7.7.2'] = 'CSCwk94350';
  smus['7.9.2'] = 'CSCwk94350';
  smus['7.10.2'] = 'CSCwk94350';
}

var vuln_ranges = [
  { 'min_ver' : '0.0', 'fix_ver' : '7.11.2' },
  { 'min_ver' : '24.1', 'fix_ver' : '24.1.2'}
];

var reporting = make_array(
  'port'          , product_info['port'],
  'severity'      , SECURITY_WARNING,
  'version'       , product_info['version'],
  'bug_id'        , 'CSCwi71881',
  'disable_caveat', TRUE
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges:vuln_ranges,
  smus:smus
);