Elasticsearch 8.x < 8.19.20 / 9.0.x < 9.4.5 Multiple Vulnerabilities (ESA-2026-76 / ESA-2026-77 / ESA-2026-118 / ESA-2026-119 / ESA-2026-133)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338341);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/20");

  script_cve_id(
    "CVE-2026-72636",
    "CVE-2026-72638",
    "CVE-2026-72647",
    "CVE-2026-72684",
    "CVE-2026-72685"
  );
  script_cwe_id(674, 770, 407);

  script_name(english:"Elasticsearch 8.x < 8.19.20 / 9.0.x < 9.4.5 Multiple Vulnerabilities (ESA-2026-76 / ESA-2026-77 / ESA-2026-118 / ESA-2026-119 / ESA-2026-133)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.20, or 9.0.x prior to 9.4.5. It is,
therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-76, ESA-2026-77, ESA-2026-118,
ESA-2026-119, and ESA-2026-133 advisories.

  - Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of
    service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns against names is
    implemented recursively and had no bound on recursion depth or on the total number of match operations
    performed. A search request containing a wildcard pattern with a large number of wildcard groups, evaluated
    against a sufficiently long name, exhausts the thread stack. (CVE-2026-72636)

  - Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation
    (CAPEC-153). An authenticated user holding only low-privileged index creation permissions can submit a single
    request containing a specially crafted, malformed custom analysis definition that is resolved recursively
    without a cycle or depth check, exhausting the thread stack and terminating the affected node.
    (CVE-2026-72638)

  - Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with
    Nested Payloads (CAPEC-230). An authenticated user holding only read privileges on a single index can submit
    one specially crafted search request whose deeply nested structure is processed without a depth limit,
    exhausting the thread stack and terminating the affected node. (CVE-2026-72647)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-76/389508
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?ac73ab73");
  # https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-77/389500
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1df75ad9");
  # https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-118/389497
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7d4fb802");
  # https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-119/389498
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?29d119ec");
  # https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-133/389499
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?82703069");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Elasticsearch version 8.19.20 or 9.4.5 or later as appropriate for your release branch.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-72636");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/20");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:elasticsearch");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elastic:elasticsearch");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("elasticsearch_detect.nbin", "elastic_elasticsearch_nix_installed.nbin");
  script_require_keys("installed_sw/Elasticsearch");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'linux'}}
  ],
  'checks': [
    {
      'product': {'name': 'Elasticsearch', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '8.0.0', 'fixed_version': '8.19.20'},
        {'min_version': '9.0.0', 'fixed_version': '9.4.5'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);