Atlassian Confluence 2.0 < 8.5.24 / 8.6.x < 9.2.6 / 9.3.x < 9.5.2 / 10.0.x < 10.0.3 RCE (CONFSERVER-100795)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(265441);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/09/19");

  script_cve_id("CVE-2025-48734");

  script_name(english:"Atlassian Confluence 2.0 < 8.5.24 / 8.6.x < 9.2.6 / 9.3.x < 9.5.2 / 10.0.x < 10.0.3 RCE (CONFSERVER-100795)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Atlassian Confluence host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in
the CONFSERVER-100795 advisory.

  - Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in
    version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum
    objects to get access to the classloader. However this protection was not enabled by default.
    PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by
    default. Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in
    an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external
    source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum's class
    loader via the declaredClass property available on all Java enum objects. Accessing the enum's
    declaredClass allows remote attackers to access the ClassLoader and execute arbitrary code. The same
    issue exists with PropertyUtilsBean.getNestedProperty(). Starting in versions 1.11.0 and 2.0.0-M2 a
    special BeanIntrospector suppresses the declaredClass property. Note that this new BeanIntrospector is
    enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide
    and the unit tests. This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before
    2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils 1.x are recommended to upgrade to
    version 1.11.0, which fixes the issue. Users of the artifact org.apache.commons:commons-beanutils2 2.x are
    recommended to upgrade to version 2.0.0-M2, which fixes the issue. (CVE-2025-48734)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://jira.atlassian.com/browse/CONFSERVER-100795");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Atlassian Confluence version 8.5.24, 9.2.6, 9.5.2, 10.0.3 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-48734");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/09/19");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:atlassian:confluence");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"enable_cgi_scanning", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("confluence_detect.nasl", "confluence_nix_installed.nbin", "confluence_win_installed.nbin");
  script_require_keys("installed_sw/Atlassian Confluence");

  exit(0);
}

include('vcf.inc');

var app_info = vcf::combined_get_app_info(app:'Atlassian Confluence');

var constraints = [
  { 'min_version' : '2.0.0', 'fixed_version' : '8.5.24' },
  { 'min_version' : '8.6.0', 'fixed_version' : '9.2.6' },
  { 'min_version' : '9.3.1', 'fixed_version' : '9.5.2' },
  { 'min_version' : '10.0.0', 'fixed_version' : '10.0.3' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);