Elasticsearch 7.17.5 / 17.17.29 / 8.2.2 < 8.19.19 / 9.x < 9.3.8 / 9.4.x < 9.4.4 Incorrect Authorization (ESA-2026-188)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(364385);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/09");

  script_cve_id("CVE-2026-102407");
  script_xref(name:"IAVA", value:"2026-A-1094");

  script_name(english:"Elasticsearch 7.17.5 / 17.17.29 / 8.2.2 < 8.19.19 / 9.x < 9.3.8 / 9.4.x < 9.4.4 Incorrect Authorization (ESA-2026-188)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Elasticsearch installed on the remote host is prior to 8.19.19, 9.3.8, 9.4.4. It is, therefore, affected
by a vulnerability as referenced in the ESA-2026-188 advisory.

  - Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via
    Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with sufficient
    privileges over a single resource could use the Modify Data Streams API to modify a data stream to which
    they were not otherwise authorized, potentially injecting data into it or affecting its ability to be
    searched normally. This issue does not allow an attacker to read the contents of a data stream they do not
    otherwise have access to. (CVE-2026-102407)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://discuss.elastic.co/t/390861");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Elasticsearch version 8.19.19, 9.3.8, or 9.4.4 or later as appropriate for your release branch.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-102407");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/09");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:elasticsearch");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elastic:elasticsearch");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("elasticsearch_detect.nbin", "elastic_elasticsearch_nix_installed.nbin");
  script_require_keys("installed_sw/Elasticsearch");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  "metadata": {
    "spec_version": "1.0"
  },
  "checks": [
    {
      "product": {
        "name": "Elasticsearch",
        "type": "app"
      },
      "check_algorithm": "default",
      "constraints": [
        {
          "min_version": "7.17.5",
          "max_version": "7.17.29",
          "fixed_display": "See vendor advisory"
        },
        {
          "min_version": "8.2.2",
          "fixed_version": "8.19.19"
        },
        {
          "min_version": "9.0.0",
          "fixed_version": "9.3.8"
        },
        {
          "min_version": "9.4.0",
          "fixed_version": "9.4.4"
        }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);