OceanBase 3.2.4 < 3.2.4.8 / 4.2.1 < 4.2.1.10 / 4.2 < 4.2.5 / 4.3.3 < 4.3.3.2 Privilege Escalation (OBVD-2025-0205)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(350910);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/29");

  script_cve_id("CVE-2025-8107");

  script_name(english:"OceanBase 3.2.4 < 3.2.4.8 / 4.2.1 < 4.2.1.10 / 4.2 < 4.2.5 / 4.3.3 < 4.3.3.2 Privilege Escalation (OBVD-2025-0205)");

  script_set_attribute(attribute:"synopsis", value:
"The remote database server is affected by a privilege escalation vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of OceanBase installed on the remote host is 3.2.4.x prior to 3.2.4.8, 4.2.1.x prior to 4.2.1.10, 4.2.x
prior to 4.2.5, or 4.3.3.x prior to 4.3.3.2. It is, therefore, affected by a privilege escalation vulnerability as
referenced in the OBVD-2025-0205 advisory.

  - In OceanBase's Oracle tenant mode, a malicious user with specific privileges can achieve privilege escalation to
    SYS-level access by executing specially crafted commands. This vulnerability only affects OceanBase tenants in
    Oracle mode; tenants in MySQL mode are unaffected. (CVE-2025-8107)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://en.oceanbase.com/legal/security-obvd-2025-0205");
  script_set_attribute(attribute:"solution", value:
"Upgrade to OceanBase version 3.2.4.8 / 4.2.1.10 / 4.2.5 / 4.3.3.2 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-8107");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/28");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oceanbase:oceanbase");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Databases");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("mysql_oceanbase_cluster_tenant_info.nbin");
  script_require_keys("installed_sw/OceanBase");

  exit(0);
}

include('vcf.inc');

var app = 'OceanBase';
var port = get_service(svc:'mysql', default:2881, exit_on_fail:TRUE);
var app_info = vcf::get_app_info(app:app, port:port, service:TRUE);

# CVE-2025-8107 affects only Oracle-mode tenants; MySQL-mode tenants are unaffected.

if ('ORACLE' >!< join(make_list(get_kb_list('Host/OceanBase/tenant/*/compat_mode')), sep:','))
  audit(AUDIT_HOST_NOT, 'affected because no OceanBase Oracle-mode tenant was detected');

var constraints = [
  {'min_version' : '3.2.4', 'fixed_version' : '3.2.4.8'},
  {'min_version' : '4.2.1', 'fixed_version' : '4.2.1.10'},
  {'min_version' : '4.2.2', 'fixed_version' : '4.2.5'},
  {'min_version' : '4.3.3', 'fixed_version' : '4.3.3.2'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);