Erlang/OTP 17.0 < 26.2.5.13 / 27.0 < 27.3.4.1 / 28.0 < 28.0.1 Path Traversal (CVE-2025-4748)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(240158);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id("CVE-2025-4748");
  script_xref(name:"IAVA", value:"2025-A-0438-S");

  script_name(english:"Erlang/OTP 17.0 < 26.2.5.13 / 27.0 < 27.3.4.1 / 28.0 < 28.0.1 Path Traversal (CVE-2025-4748)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Erlang/OTP installed on the remote host is 17.0 prior to 26.2.5.13, 27.0 prior to 27.3.4.1, or 28.0
prior to 28.0.1. It is, therefore, affected by an path traversal vulnerability:

  - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP 
    (stdlib modules) allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with 
    program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2, zip:extract/1, 
    zip:extract/2 unless the memory option is passed. This issue affects OTP from OTP 17.0 until OTP 28.0.1, 
    OTP 27.3.4.1 and OTP 26.2.5.13, corresponding to stdlib from 2.0 until 7.0.1, 6.2.2.1 and 5.2.3.4. 
    (CVE-2025-4748)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/erlang/otp/security/advisories/GHSA-9g37-pgj9-wrhc");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Erlang/OTP version 26.2.5.13, 27.3.4.1, or 28.0.1 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-4748");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/06/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/06/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:erlang:erlang%2fotp");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ericcson_erlang_otp_win_installed.nbin", "ericsson_erlang_otp_nix_installed.nbin");
  script_require_keys("installed_sw/Erlang-OTP");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Erlang-OTP', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version':'17.0','fixed_version':'26.2.5.13'},
        {'min_version':'27.0','fixed_version':'27.3.4.1'},
        {'min_version':'28.0','fixed_version':'28.0.1'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);