Traefik < 2.11.41 / 3.x < 3.6.11 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(303797);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/08");

  script_cve_id("CVE-2026-32305", "CVE-2026-32595");
  script_xref(name:"IAVB", value:"2026-B-0077-S");

  script_name(english:"Traefik < 2.11.41 / 3.x < 3.6.11 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote macOS host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Traefik installed on the remote macOS host is prior to 2.11.41 or 3.x prior to 3.6.11. It is,
therefore, affected by multiple vulnerabilities:

  - mTLS bypass through the TLS SNI pre-sniffing logic related to fragmented ClientHello packets. When a TLS
    ClientHello is fragmented across multiple records, Traefik's SNI extraction may fail with an EOF and return
    an empty SNI. The TCP router then falls back to the default TLS configuration, which does not require client
    certificates by default. This allows an attacker to bypass route-level mTLS enforcement and access services
    that should require mutual TLS authentication. (CVE-2026-32305)

  - BasicAuth middleware allows username enumeration via a timing attack. When a submitted username exists, the
    middleware performs a bcrypt password comparison taking significantly longer than when the username does not
    exist. This timing difference is observable over the network and allows an unauthenticated attacker to
    reliably distinguish valid from invalid usernames. (CVE-2026-32595)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported
version number.");
  # https://github.com/traefik/traefik/security/advisories/GHSA-wvvq-wgcr-9q48
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?143fb341");
  # https://github.com/traefik/traefik/security/advisories/GHSA-g3hg-j4jv-cwfr
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2e719244");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Traefik version 2.11.41, 3.6.11, or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-32305");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:traefik:traefik");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("macos_traefik_installed.nbin");
  script_require_keys("Host/local_checks_enabled", "installed_sw/traefik");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {
      'scope': 'target',
      'match': {'os': 'macos'}
    }
  ],
  'checks': [
    {
      'product': {'name': 'traefik', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '2.11.41'},
        {'min_version': '3.0.0', 'fixed_version': '3.6.11'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);