Elasticsearch 8.0.x < 8.19.17 / 9.0.x < 9.3.6 / 9.4.x < 9.4.3 Multiple DoS

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(324974);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/03");

  script_cve_id("CVE-2026-56148", "CVE-2026-56149");

  script_name(english:"Elasticsearch 8.0.x < 8.19.17 / 9.0.x < 9.3.6 / 9.4.x < 9.4.3 Multiple DoS");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple denial of service vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Elasticsearch installed on the remote host is 8.0 prior to 8.19.17, 9.0 prior to 9.3.6, or 9.4.0 prior
to 9.4.3. It is, therefore, affected by multiple denial of service vulnerabilities:

  - Uncontrolled recursion in Elasticsearch allows an authenticated user to submit a specially crafted query that causes
    excessive resource consumption while the request is processed, which may render the affected node unavailable.
    (CVE-2026-56148)

  - Allocation of resources without limits or throttling in Elasticsearch allows a user with elevated privileges to
    submit a specially crafted machine learning request that causes excessive memory consumption, which may render the
    affected node unavailable. (CVE-2026-56149)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://discuss.elastic.co/t/elasticsearch-8-19-17-9-3-6-9-4-3-security-update-esa-2026-42
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?62d9193c");
  # https://discuss.elastic.co/t/elasticsearch-8-19-17-9-3-6-9-4-3-security-update-esa-2026-43
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8db5da17");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Elasticsearch version 8.19.17, 9.3.6, or 9.4.3 or later as appropriate for your release branch.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-56148");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/03");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:elasticsearch");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elastic:elasticsearch");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("elasticsearch_detect.nbin", "elastic_elasticsearch_nix_installed.nbin");
  script_require_keys("installed_sw/Elasticsearch");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Elasticsearch', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints' : [
         { 'min_version' : '8.0.0', 'fixed_version' : '8.19.17' },
         { 'min_version' : '9.0.0', 'fixed_version' : '9.3.6' },
         { 'min_version' : '9.4.0', 'fixed_version' : '9.4.3' }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);