Drupal 10.6.x < 10.6.17 / 11.3.x < 11.3.17 / 11.4.x < 11.4.7 Drupal Vulnerability (SA-CORE-2026-013)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(346470);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/16");

  script_name(english:"Drupal 10.6.x < 10.6.17 / 11.3.x < 11.3.17 / 11.4.x < 11.4.7 Drupal Vulnerability (SA-CORE-2026-013) ");

  script_set_attribute(attribute:"synopsis", value:
"A PHP application running on the remote web server is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the instance of Drupal running on the remote web server is 10.6.x prior to
10.6.17, 11.3.x prior to 11.3.17, or 11.4.x prior to 11.4.7. It is, therefore, affected by a vulnerability.

  - The Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update
    that impacts Drupal. Vulnerabilities are possible if Drupal is configured to use CKEditor for WYSIWYG
    editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be
    able to exploit this Cross-Site Scripting (XSS) vulnerability to target users with access to the WYSIWYG
    CKEditor, including site admins with privileged access. For more information, see CKEditor's security
    advisory: High-severity Cross-site scripting (XSS) in the engine package (SA-CORE-2026-013)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.drupal.org/sa-core-2026-013");
  script_set_attribute(attribute:"see_also", value:"https://github.com/ckeditor/ckeditor5");
  # https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-rh54-vffm-5fvp
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2cbd9462");
  # https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-v6mg-96c6-gmpq
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d16581be");
  script_set_attribute(attribute:"see_also", value:"https://www.drupal.org/project/drupal/releases/10.6.17");
  script_set_attribute(attribute:"see_also", value:"https://www.drupal.org/project/drupal/releases/11.3.17");
  script_set_attribute(attribute:"see_also", value:"https://www.drupal.org/project/drupal/releases/11.4.7");
  script_set_attribute(attribute:"see_also", value:"https://www.drupal.org/psa-2011-002");
  script_set_attribute(attribute:"see_also", value:"https://www.drupal.org/psa-2021-06-29");
  script_set_attribute(attribute:"see_also", value:"https://www.drupal.org/psa-2023-11-01");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Drupal version 10.6.17 / 11.3.17 / 11.4.7 or later.");
  script_set_attribute(attribute:"risk_factor", value:"High");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/16");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:drupal:drupal");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("drupal_detect.nasl");
  script_require_keys("installed_sw/Drupal", "Settings/ParanoidReport");
  script_require_ports("Services/www", 80, 443);

  exit(0);
}

include('vcf.inc');
include('http.inc');

if (report_paranoia < 2) audit(AUDIT_PARANOID);

var port = get_http_port(default:80, php:TRUE);

var app_info = vcf::get_app_info(app:'Drupal', port:port, webapp:TRUE);

vcf::check_granularity(app_info:app_info, sig_segments:2);

var constraints = [
  { 'min_version' : '10.6.0', 'fixed_version' : '10.6.17' },
  { 'min_version' : '11.3.0', 'fixed_version' : '11.3.17' },
  { 'min_version' : '11.4.0', 'fixed_version' : '11.4.7' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE,
    flags:{'xss':TRUE}
);