NewStart CGSL MAIN 7.02 : nginx Multiple Vulnerabilities (NS-SA-2026-0104)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from ZTE advisory NS-SA-2026-0104. The text
# itself is copyright (C) ZTE, Inc.
##

include('compat.inc');

if (description)
{
  script_id(343561);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/08");

  script_cve_id("CVE-2025-23419", "CVE-2025-53859");
  script_xref(name:"IAVA", value:"2025-A-0086");
  script_xref(name:"IAVA", value:"2025-A-0615");

  script_name(english:"NewStart CGSL MAIN 7.02 : nginx Multiple Vulnerabilities (NS-SA-2026-0104)");

  script_set_attribute(attribute:"synopsis", value:
"The remote NewStart CGSL host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote NewStart CGSL host, running version MAIN 7.02, has nginx packages installed that are affected by multiple
vulnerabilities:

  - When multiple server blocks are configured to share the same IP address and port, an attacker can use
    session resumption to bypass client certificate authentication requirements on these servers. This
    vulnerability arises when TLS Session Tickets
    https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL
    session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the
    default server and the default server is performing client certificate authentication. Note: Software
    versions which have reached End of Technical Support (EoTS) are not evaluated. (CVE-2025-23419)

  - NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an
    unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server
    side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during
    the NGINX SMTP authentication process and requires the attacker to make preparations against the target
    system to extract the leaked data. The issue affects NGINX only if (1) it is built with the
    ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method none, and (3) the
    authentication server returns the Auth-Wait response header. Note: Software versions which have reached
    End of Technical Support (EoTS) are not evaluated. (CVE-2025-53859)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/notice/NS-SA-2026-0104");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2025-23419");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2025-53859");
  script_set_attribute(attribute:"solution", value:
"Upgrade the vulnerable CGSL nginx packages. Note that updated packages may not be available yet. Please contact ZTE for
more information.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-23419");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2025-53859");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/02/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:nginx");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:nginx-all-modules");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:nginx-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:nginx-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:nginx-filesystem");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:nginx-mod-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:nginx-mod-http-image-filter");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:nginx-mod-http-perl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:nginx-mod-http-xslt-filter");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:nginx-mod-mail");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:nginx-mod-stream");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:zte:cgsl_main:7");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"NewStart CGSL Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/ZTE-CGSL/release", "Host/ZTE-CGSL/rpm-list", "Host/cpu");

  exit(0);
}

include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var os_release = get_kb_item('Host/ZTE-CGSL/release');
if (isnull(os_release) || os_release !~ "^CGSL (MAIN|CORE)") audit(AUDIT_OS_NOT, 'NewStart Carrier Grade Server Linux');

if (os_release !~ "CGSL\sMAIN\s7\.02")
  audit(AUDIT_OS_NOT, 'NewStart CGSL MAIN 7.02');

if (!get_kb_item('Host/ZTE-CGSL/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'NewStart Carrier Grade Server Linux', cpu);

var flag = 0;

var pkgs = {
  'CGSL MAIN 7.02': [
    'nginx-1.26.2-3.zncgsl7',
    'nginx-all-modules-1.26.2-3.zncgsl7',
    'nginx-core-1.26.2-3.zncgsl7',
    'nginx-doc-1.26.2-3.zncgsl7',
    'nginx-filesystem-1.26.2-3.zncgsl7',
    'nginx-mod-devel-1.26.2-3.zncgsl7',
    'nginx-mod-http-image-filter-1.26.2-3.zncgsl7',
    'nginx-mod-http-perl-1.26.2-3.zncgsl7',
    'nginx-mod-http-xslt-filter-1.26.2-3.zncgsl7',
    'nginx-mod-mail-1.26.2-3.zncgsl7',
    'nginx-mod-stream-1.26.2-3.zncgsl7'
  ]
};
var pkg_list = pkgs[os_release];
var pkg;
foreach (pkg in pkg_list)
  if (rpm_check(reference:pkg, release:'ZTE ' + os_release, rpm_spec_vers_cmp:TRUE)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'nginx');
}