Elastic APM Server 8.x < 8.19.20 / 9.0.x < 9.4.5 / 9.5.x < 9.5.1 DoS (ESA-2026-152)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(347966);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/18");

  script_cve_id("CVE-2026-78594");
  script_xref(name:"IAVA", value:"2026-A-1006");

  script_name(english:"Elastic APM Server 8.x < 8.19.20 / 9.0.x < 9.4.5 / 9.5.x < 9.5.1 DoS (ESA-2026-152)");

  script_set_attribute(attribute:"synopsis", value:
"The Elastic APM Server installation on the remote host is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Elastic APM Server installed on the remote host is 8.x prior to 8.19.20, or 9.0.x prior to 9.4.5, or
9.5.x prior to 9.5.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-152 advisory.

  - Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of
    service via Excessive Allocation (CAPEC-130). An authenticated user with write access to source map
    content could store specially crafted, highly compressed content that exhausts the memory available to
    APM Server when it is later processed, terminating the process. The condition recurs on every restart
    until the stored content is removed. (CVE-2026-78594)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://discuss.elastic.co/t/apm-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-152/390110
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5ae6c387");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Elastic APM Server version 8.19.20, 9.4.5, or 9.5.1 or later as appropriate for your release branch.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:M/C:N/I:N/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-78594");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/18");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elastic:apm_server");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("elastic_apm_server_win_installed.nbin", "elastic_apm_server_nix_installed.nbin");
  script_require_keys("installed_sw/Elastic APM Server", "Settings/ParanoidReport");

  exit(0);
}

include('vdf.inc');

# Not checking whether Real User Monitoring (RUM) is enabled with source map fetching configured
if (report_paranoia < 2) audit(AUDIT_PARANOID);

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'paranoia': true}}
  ],
  'checks': [
    {
      'product': {'name': 'Elastic APM Server', 'type': 'app'},
      'check_algorithm': 'default',
      'potential_vulnerability': {
        'missing_config_check': true
      },
      'constraints': [
        {'min_version': '8.0.0', 'fixed_version': '8.19.20'},
        {'min_version': '9.0.0', 'fixed_version': '9.4.5'},
        {'min_version': '9.5.0', 'fixed_version': '9.5.1'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);