Dell PowerScale OneFS Unauthorised File Access Vulnerability (DSA-2025-208)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable Network Security, Inc.
##

include('compat.inc');

if (description)
{
  script_id(296598);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/03");

  script_cve_id("CVE-2024-53298");

  script_name(english:"Dell PowerScale OneFS Unauthorised File Access Vulnerability (DSA-2025-208)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch");
  script_set_attribute(attribute:"description", value:
"The Dell PowerScale OneFS on the remote device is missing a security patch and is, therefore, affected by 
a Unauthorised File Access Vulnerability: 

- Dell PowerScale OneFS, versions 9.5.0.0 <= 9.5.1.2 / 9.7.0.0 <= 9.7.1.7 / 9.8.0.0 <= 9.10.0.1, contain a missing 
  authorization vulnerability in the NFS export. An unauthenticated attacker with remote access could potentially 
  exploit this vulnerability leading to unauthorized filesystem access. The attacker may be able to read, modify, 
  and delete arbitrary files. (CVE-2024-53298)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.dell.com/support/kbdoc/en-ie/000326339/dsa-2025-208-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?83eb63bc");
  script_set_attribute(attribute:"solution", value:
"Apply the security patch in accordance with the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-53298");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/06/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/26");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:dell:powerscale_onefs");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("dell_powerscale_onefs_detect.nbin");
  script_require_keys("installed_sw/Dell PowerScale OneFS", "Settings/ParanoidReport");

  exit(0);
}
include('vdf.inc');

if (report_paranoia < 2) audit(AUDIT_PARANOID);

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Dell PowerScale OneFS', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        { 'min_version':'9.5.0.0', 'fixed_version': '9.5.1.3'},
        { 'min_version':'9.7.0.0', 'fixed_version': '9.7.1.8'},
        { 'min_version':'9.8.0.0', 'max_version': '9.10.0.1', 'fixed_display' : '9.10.1.0'}
      ]
    }
  ]
};
var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);