Curl 7.21.0 < 8.23.0 FTP Wildcard Use-After-Free

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(371154);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/23");

  script_cve_id("CVE-2026-92388");
  script_xref(name:"IAVA", value:"2026-A-1143");

  script_name(english:"Curl 7.21.0 < 8.23.0 FTP Wildcard Use-After-Free");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has a program that is affected by a use-after-free vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of curl installed on the remote host is 7.21.0 prior to 8.23.0. It is, therefore, affected by
a use-after-free vulnerability:

  - When an FTP wildcard LIST operation fails, libcurl omits the restoration path meant for
    successful listings, leaving the write callback set to the internal listing parser and the
    write callback data pointing directly to the easy handle. Subsequent reuse of this handle
    triggers an immediate crash, and cloning it via curl_easy_duphandle() copies this corrupted
    state into the duplicate. If the original handle is subsequently freed, executing a transfer
    on the cloned handle causes a heap use-after-free read against the dangling handle reference;
    alternatively, reusing the original or cloned handle while changing only CURLOPT_WRITEDATA
    (and omitting CURLOPT_WRITEFUNCTION) results in type confusion, forcing the internal parser
    to interpret incoming server response bytes into memory at the application-supplied write data
    pointer. (CVE-2026-92388)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://curl.se/docs/CVE-2026-92388.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade Curl to version 8.23.0 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"manual");
  script_set_attribute(attribute:"cvss_score_rationale", value:"score from an analysis done by Tenable");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/23");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:haxx:curl");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("curl_win_installed.nbin", "curl_nix_installed.nbin");
  script_require_keys("installed_sw/Curl");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Curl', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '7.21.0', 'fixed_version': '8.23.0'}
      ]
    }
  ]
};

var res = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:res);