NetScaler ADC and NetScaler Gateway Memory Overflow (CTX694788)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(240342);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/07/08");

  script_cve_id("CVE-2025-6543");
  script_xref(name:"IAVA", value:"2025-A-0443");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/07/21");

  script_name(english:"NetScaler ADC and NetScaler Gateway Memory Overflow (CTX694788)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is affected by a memory overflow vulnerability.");
  script_set_attribute(attribute:"description", value:
"The remote NetScaler ADC (formerly Citrix ADC) or NetScaler Gateway (formerly Citrix Gateway) device is version 14.1
prior to 14.1-47.46, 13.1 prior to 13.1-59.19, or 13.1-FIPS prior to 13.1-37.236-FIPS. It if, therefore, affected by a
memory overflow vulnerability:

  - Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and
    NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual
    server. (CVE-2025-6543)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b3df6540");
  script_set_attribute(attribute:"solution", value:
"Upgrade to NetScaler ADC or NetScaler Gateway version 13.1-37.236-FIPS, 13.1-59.19, or 14.1-47.46 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:A");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-6543");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/06/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/06/25");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:citrix:netscaler_gateway");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:citrix:netscaler_application_delivery_controller");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("citrix_netscaler_detect.nbin");
  script_require_keys("Host/NetScaler/Detected");

  exit(0);
}

include('vcf_extras_netscaler.inc');

var app_info = vcf::citrix_netscaler::get_app_info();

var constraints;

if (app_info['fips_status'] == 1)
  constraints = [
    {'fips':TRUE, 'min_version': '13.1', 'fixed_version': '13.1.37.236', 'fixed_display':'13.1-37.236-FIPS'}
  ];
else
  constraints = [
    {'min_version': '12.1', 'fixed_version': '12.9999999',
      'fixed_display': '12.1 is now End Of Life (EOL) and is vulnerable. Upgrade to a supported fixed release.'},
    {'min_version': '13.0', 'fixed_version': '13.0.9999999',
      'fixed_display': '13.0 is now End Of Life (EOL) and is vulnerable. Upgrade to a supported fixed release.'},
    {'min_version': '13.1', 'fixed_version': '13.1.59.19', 'fixed_display': '13.1-59.19'},
    {'min_version': '14.1', 'fixed_version': '14.1.47.46', 'fixed_display': '14.1-47.46'}
  ];

vcf::citrix_netscaler::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE
);