Elastic Beats filebeat < 9.1.0 Privilege Escalation

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(246127);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id("CVE-2025-25011");
  script_xref(name:"IAVB", value:"2025-B-0129-S");

  script_name(english:"Elastic Beats filebeat < 9.1.0 Privilege Escalation");

  script_set_attribute(attribute:"synopsis", value:
"Elastic Beats filebeat installed on the remote Windows host is affected by an privilege escalation vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Elastic Beats filebeat installed on the remote host is prior to 9.1.0. It is, therefore,
affected by a vulnerability. An uncontrolled search path element vulnerability can lead to local privilege Escalation 
(LPE) via Insecure Directory Permissions. The vulnerability arises from improper handling of directory permissions. An 
attacker with local access may exploit this flaw to move and delete arbitrary files, potentially gaining SYSTEM 
privileges.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://discuss.elastic.co/t/beats-windows-installer-9-1-0-security-update-esa-2025-12/380558
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?262ca926");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Elastic Beats filebeat version 9.1.0 or later.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-25011");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/08/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/a:elastic:beats_filebeat");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("elastic_beats_filebeat_win_installed.nbin");
  script_require_keys("installed_sw/Beats filebeat", "SMB/Registry/Enumerated");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'windows'}}
  ],
  'checks': [
    {
      'product': {'name': 'Beats filebeat', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '9.1.0'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);