Golang < 1.19.11 / 1.20.x < 1.20.6 Security Bypass

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(178844);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/12");

  script_cve_id("CVE-2023-29406");
  script_xref(name:"IAVB", value:"2023-B-0052-S");

  script_name(english:"Golang < 1.19.11 / 1.20.x < 1.20.6 Security Bypass");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote Windows host is affected by security bypass vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Golang Go installed on the remote host is affected by security bypass vulnerability. The HTTP/1 client 
does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional 
headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host 
or Request.URL.Host value.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://go.dev/issue/60374");
  # https://groups.google.com/g/golang-announce/c/2q13H6LEEx0
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e3b05c71");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Golang Go version 1.19.11, 1.20.6, or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-29406");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/07/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/07/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/07/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:golang:go");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2023-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("golang_win_installed.nbin");
  script_require_keys("installed_sw/Golang Go Programming Language", "SMB/Registry/Enumerated");

  exit(0);
}

include('vcf.inc');
get_kb_item_or_exit('SMB/Registry/Enumerated');

var app_info = vcf::get_app_info(app:'Golang Go Programming Language', win_local:TRUE);

var constraints = [
  { 'fixed_version' : '1.19.11' },
  { 'min_version' : '1.20', 'fixed_version' : '1.20.6' },
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);