DELMIA Apriso Missing Authorization Vulnerability (CVE-2025-6205)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(272294);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/05");

  script_cve_id("CVE-2025-6205");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/11/18");

  script_name(english:"DELMIA Apriso Missing Authorization Vulnerability (CVE-2025-6205)");

  script_set_attribute(attribute:"synopsis", value:
"DELMIA Apriso is affected by an a missing authorization vulnerability that could allow gain privileged access to the application.");
  script_set_attribute(attribute:"description", value:
"The version of DELMIA Apriso installed on the remote host is Release 2020 through Release 2025. It is, therefore, 
affected by a missing authorization vulnerability (CVE-2025-6205) that could allow an attacker to gain privileged 
access to the application. Exploitation can be achieved by sending specially crafted SOAP requests to the product’s 
message processor which may create arbitrary employee accounts and assign them privileged roles, enabling privilege 
escalation and further malicious actions such as configuration changes, deployment of malicious artifacts, or 
chaining with other Apriso flaws to achieve remote code execution and broader system compromise.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.3ds.com/trust-center/security/security-advisories/cve-2025-6205
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5b623d81");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the latest version.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-6205");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/08/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/08/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/05");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:3ds:delmia_apriso");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("dassault_systemes_delmia_apriso.nbin");
  script_require_keys("SMB/Registry/Enumerated", "installed_sw/Dassault Systèmes DELMIA Apriso");

  exit(0);
}

include('vcf.inc');

get_kb_item_or_exit('SMB/Registry/Enumerated');

var app_info = vcf::get_app_info(app:'Dassault Systèmes DELMIA Apriso', win_local:TRUE);
var product_year = app_info['product_version'];

if (empty_or_null(product_year))
{
    exit(0, "The release year of Dassault Systèmes DELMIA Apriso could not be determined.");;
}

if (product_year !~ "202[012345]")
{
    audit(AUDIT_HOST_NOT,'affected');
}

var report =
  '\n' + 'Nessus detected the vulnerable release:' +
  '\n' + join(product_year, sep:'\n') +
  'See Vendor Advisory.';

security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : report
  );