Plone RestrictedPython < 5.3 / 6.x < 6.1 RCE

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(329023);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/23");

  script_cve_id("CVE-2023-37271");

  script_name(english:"Plone RestrictedPython < 5.3 / 6.x < 6.1 RCE");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by a remote code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of RestrictedPython installed on the remote host is prior to 5.3, or 6.x prior to 6.1. It is, therefore,
affected by a remote code execution vulnerability due to not checking access to stack frames and their attributes. An
authenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands within the
current stack frame.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/zopefoundation/RestrictedPython/commit/c8eca66ae49081f0016d2e1f094c3d72095ef531
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?db687ce1");
  # https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-wqc8-x2pr-7jqh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?902386cc");
  script_set_attribute(attribute:"solution", value:
"Upgrade to RestrictedPython version 5.3, 6.1 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-37271");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/07/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/07/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:zope:restrictedpython");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("python_plone_detect.nbin");
  script_require_ports("Host/nix/Python/Packages/Enumerated", "Host/win/Python/Packages/Enumerated");

  exit(0);
}

include('python.inc');

var pkg = 'restrictedpython';
var cpe = 'cpe:/a:zope:restrictedpython';

var libs = python::get_package_info(pkg_name:pkg, cpe:cpe);
if (empty_or_null(libs))
  audit(AUDIT_NOT_INST, pkg);

vcf::check_all_backporting(app_info:libs);

var constraints = [
  {'fixed_version': '5.3'},
  {'min_version': '6', 'fixed_version': '6.1'}
];

vcf::check_version_and_report(app_info:libs, constraints:constraints, severity:SECURITY_HOLE);