Dell Data Domain OS Command Injection (DSA-2025-159)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(265948);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/09/26");

  script_cve_id(
    "CVE-2023-52340",
    "CVE-2024-42154",
    "CVE-2024-9143",
    "CVE-2024-5535",
    "CVE-2025-30096",
    "CVE-2025-30097",
    "CVE-2025-30098",
    "CVE-2025-30099"
  );
  script_xref(name:"IAVA", value:"2025-A-0584");

  script_name(english:"Dell Data Domain OS Command Injection (DSA-2025-159)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Windows host contains a Dell Data Domain OS install that is affected by a command injection vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version number, the version of Dell Data Domain OS is affected by a command
injection vulnerability as disclosed in the DSA-2025-159 advisory:

  - Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions
  7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions
  7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Special Elements used in an OS Command
  ('OS Command Injection') vulnerability in the DDSH CLI. A low privileged attacker with local access could
  potentially exploit this vulnerability to execute arbitrary commands with root privileges. (CVE-2025-30099)

  - Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions
  7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0 through 7.13.1.25, LTS 2023 release versions
  7.10.1.0 through 7.10.1.50, contain an Improper Neutralization of Special Elements used in an OS Command
  ('OS Command Injection') vulnerability in the DDSH CLI. A high privileged attacker with local access could
  potentially exploit this vulnerability to execute arbitrary commands with root privileges. (CVE-2025-30098,
  CVE-2025-30097, CVE-2025-30096)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
# https://www.dell.com/support/kbdoc/en-us/000348708/dsa-2025-159-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e605fcdd");
  script_set_attribute(attribute:"solution", value:
"Update Dell Data Domain OS to Feature Release 8.3.0.10 or later.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-30099");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/31");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/09/26");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:dell:data_domain_operating_system");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("dell_data_domain_operating_system_web_interface_detect.nbin");
  script_require_keys("installed_sw/Dell Data Domain Operating System", "Settings/ParanoidReport");
  script_require_ports('Services/www', 443);

  exit(0);
}

include('vcf.inc');

var app_name = 'Dell Data Domain Operating System';
var app_info = vcf::combined_get_app_info(app:app_name);

# currently can't detect the release (e.g. Feature Release, LTS2024 or LTS2023)
if (report_paranoia < 2) audit(AUDIT_PARANOID);

# constraints are based on Feature Release affected/fixed version(s)
var constraints = [
  {'min_version': '7.7.1.0', 'max_version': '7.10.1.50', 'fixed_version': '7.10.1.60'},
  {'min_version': '7.13.1.0', 'max_version': '7.13.1.25', 'fixed_version': '7.13.1.30'},
  {'min_version': '7.14', 'max_version': '8.1.0.10', 'fixed_version': '8.3.0.10'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);