Keycloak <= 26.3.2 SMTP Inject (GHSA-qj5r-2r5p-phc7)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(246413);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id("CVE-2025-8419");
  script_xref(name:"IAVB", value:"2025-B-0130-S");

  script_name(english:"Keycloak <= 26.3.2 SMTP Inject (GHSA-qj5r-2r5p-phc7)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Keycloak installed on the remote host is prior or equal to 26.3.2. It is, therefore, affected by SMTP 
inject vulnerability as reference in GHSA-qj5r-2r5p-phc7 advisory.

  - A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may 
    perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 
    characters (limited local part of the email), so the attack is limited to very shorts emails (subject and 
    little data, the example is 60 chars). This flaw's only direct consequence is an unsolicited email being 
    sent from the Keycloak server. However, this action could be a precursor for more sophisticated attacks.
    (CVE-2025-8419)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/advisories/GHSA-qj5r-2r5p-phc7");
  script_set_attribute(attribute:"solution", value:
"See vendor advisory");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-8419");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/08/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/08/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/08/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:keycloak:keycloak");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("keycloak_nix_installed.nbin");
  script_require_keys("installed_sw/Keycloak");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'linux'}}
  ],
  'checks': [
    {
      'product': {'name': 'Keycloak', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints' : [
        { 'max_version' : '26.3.2', 'fixed_display' : 'See vendor advisory' }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);