Palo Alto Networks Prisma SD-WAN ION 5.6.x < 5.6.19 / 6.1.x < 6.1.8 / 6.2.x / 6.3.x < 6.3.2 SSH Prefix Truncation (Terrapin) (CVE-2023-48795)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(298997);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/16");

  script_cve_id("CVE-2023-48795");

  script_name(english:"Palo Alto Networks Prisma SD-WAN ION 5.6.x < 5.6.19 / 6.1.x < 6.1.8 / 6.2.x / 6.3.x < 6.3.2 SSH Prefix Truncation (Terrapin) (CVE-2023-48795)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Palo Alto Networks Prisma SD-WAN ION host is affected by an SSH prefix truncation vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of the remote Palo Alto Networks Prisma SD-WAN ION device is 5.6.x prior to 5.6.19, 6.1.x prior to 6.1.8,
6.2.x, or 6.3.x prior to 6.3.2. It is, therefore, affected by an SSH prefix truncation vulnerability known as Terrapin:

  - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows
    remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation
    message), and a client and server may consequently end up with a connection for which some security features have
    been downgraded or disabled, aka a Terrapin attack. (CVE-2023-48795)

Note that Nessus has not tested for this issue but has instead relied only on the device's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security.paloaltonetworks.com/CVE-2023-48795");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Palo Alto Networks Prisma SD-WAN ION version 5.6.19, 6.1.8, or 6.3.2 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-48795");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/01/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/01/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/13");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:paloaltonetworks:prisma_ion_os");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:paloaltonetworks:prisma_ion");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Palo Alto Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("palo_alto_prisma_ion_detect.nbin");
  script_require_keys("installed_sw/Palo Alto Networks Prisma ION");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Palo Alto Networks Prisma ION', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '5.6', 'fixed_version':'5.6.19'},
        {'min_version': '6.1', 'fixed_version':'6.1.8'},
        {'min_version': '6.2', 'max_version':'6.2.9999', 'fixed_display':'6.3.2'},
        {'min_version': '6.3', 'fixed_version':'6.3.2'}
      ]
    }
  ]
};

var res = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:res);