HCL BigFix Remote Control <= 10.1.0.0442 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(318683);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/08");

  script_cve_id("CVE-2026-21785", "CVE-2026-33870", "CVE-2026-33871");
  script_xref(name:"IAVA", value:"2026-A-0531");

  script_name(english:"HCL BigFix Remote Control <= 10.1.0.0442 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"An application running on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of HCL BigFix Remote Control running on the remote host is 10.1.0.0442 or earlier. It is, therefore,
affected by multiple vulnerabilities:

  - A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions
    10.1.0.0442 and earlier) fails to define directives without fallbacks, allowing attackers to bypass
    intended security restrictions and load unauthorized resources. (CVE-2026-21785)

  - Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling
    request smuggling attacks. (CVE-2026-33870)

  - Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final
    and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by
    sending a flood of CONTINUATION frames. The server's lack of a limit on the number of CONTINUATION frames,
    combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause
    excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. (CVE-2026-33871)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported
version number.");
  # https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130581
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?cac5396a");
  script_set_attribute(attribute:"solution", value:
"Upgrade to HCL BigFix Remote Control 10.1 Fix Pack 5 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-33871");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(444, 770, 1021);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/04");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:bigfix_remote_control");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:tivoli_remote_control");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ibm_bigfix_remote_control.nbin");
  script_require_keys("installed_sw/IBM BigFix Remote Control");
  script_require_ports("Services/www", 80, 443, 9080, 9443);

  exit(0);
}

include('vcf.inc');
include('http.inc');

var app = 'IBM BigFix Remote Control';

var constraints = [
  {'min_version': '0.0', 'max_version': '10.1.0.0442', 'fixed_display': 'HCL BigFix Remote Control 10.1 Fix Pack 5'}
];

var port = get_http_port(default:80);

var app_info = vcf::get_app_info(app:app, port:port, webapp:true);

vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE
);