Ivanti Sentri RCE (CVE-2023-41724)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(204918);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/08/05");

  script_cve_id("CVE-2023-41724");

  script_name(english:"Ivanti Sentri RCE (CVE-2023-41724)");

  script_set_attribute(attribute:"synopsis", value:
"Ivanti Sentry, running on the remote host is affected by a remote code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"A security vulnerability in Ivanti MobileIron Sentry versions 9.19.0, 9.18.0, and 19.17.0 and below, which may allow 
an attacker to execute arbitrary commands on the underlying operating system of the appliance within the same physical 
or logical network.

Note that Nessus has not tested for these issues but has instead relied only on the service's self-reported version
number.");
  # https://forums.ivanti.com/s/article/KB-CVE-2023-41724-Remote-Code-Execution-for-Ivanti-Standalone-Sentry
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d115e2e7");
  script_set_attribute(attribute:"solution", value:
"Update to Ivanti Sentry version 9.17.1, 9.18.1, 9.19.1 or later");
  script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-41724");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/03/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/03/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/07/31");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ivanti:sentry");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ivanti_sentry_detect.nbin");
  script_require_keys("installed_sw/Ivanti Sentry");

  exit(0);
}

include('vcf.inc');

var app_info = vcf::get_app_info(app:'Ivanti Sentry');

var constraints = [
  # Advisory states "older versions are also at risk"
  { 'min_version':'0.0', 'fixed_version':'9.17.1' },
  { 'min_version':'9.18.0', 'fixed_version':'9.18.1' },
  { 'min_version':'9.19.0', 'fixed_version':'9.19.1' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);