nginx 0.7.22 < 1.29.1 Information Disclosure

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(253588);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/08/22");

  script_cve_id("CVE-2025-53859");
  script_xref(name:"IAVA", value:"2025-A-0615");

  script_name(english:"nginx 0.7.22 < 1.29.1 Information Disclosure");

  script_set_attribute(attribute:"synopsis", value:
"The remote web server is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its Sever response header, the installed version of nginx is 0.7.22 prior to 1.29.1. It is, therefore,
affected by the following issue :

  - NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an
    unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server
    side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during
    the NGINX SMTP authentication process and requires the attacker to make preparations against the target
    system to extract the leaked data. The issue affects NGINX only if (1) it is built with the
    ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method none, and (3) the
    authentication server returns the Auth-Wait response header. Note: Software versions which have reached
    End of Technical Support (EoTS) are not evaluated. (CVE-2025-53859)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://my.f5.com/manage/s/article/K000152786");
  script_set_attribute(attribute:"see_also", value:"https://www.cve.org/CVERecord?id=CVE-2025-53859");
  script_set_attribute(attribute:"solution", value:
"Upgrade to nginx 1.29.1 or later.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-53859");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/08/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/08/22");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:igor_sysoev:nginx");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nginx_detect.nasl", "nginx_nix_installed.nbin");
  script_require_keys("Settings/ParanoidReport", "installed_sw/nginx");

  exit(0);
}

include('vcf.inc');
include('http.inc');

# Vulnerable module is not compiled by default
if (report_paranoia < 2)
  audit(AUDIT_PARANOID);

var appname = 'nginx';
get_install_count(app_name:appname, exit_if_zero:TRUE);

var app_info = vcf::combined_get_app_info(app:appname);
vcf::check_granularity(app_info:app_info, sig_segments:3);

var constraints = [
  { 'min_version' : '0.7.22', 'fixed_version' : '1.29.1' }
];
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_NOTE
);