Plone Volto < 16.34.0 / 17.x < 17.22.1 / 18.x < 18.24.0 / 19.0.0-alpha.1 < 19.0.0-alpha.4 DoS

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(329035);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/23");

  script_cve_id("CVE-2025-58047");

  script_name(english:"Plone Volto < 16.34.0 / 17.x < 17.22.1 / 18.x < 18.24.0 / 19.0.0-alpha.1 < 19.0.0-alpha.4 DoS");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by a denial of service vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of the @plone/volto Node.js Package installed on the remote host is prior to 16.34.0, or 17.x prior to
17.22.1, or 18.x prior to 18.24.0, or 19.0.0-alpha.1 prior to 19.0.0-alpha.4. It is, therefore, affected by a denial of
service vulnerability. An unauthenticated, remote attacker, can exploit this issue, via a specific URL, to cause the
NodeJS server part of Volto to stop responding.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://plone.org/security/announcements/plone-security-advisory-20250828
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0c02fe37");
  # https://github.com/plone/volto/commit/2789a287ac45ad9039fb9161d465ba13241fff0a
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?722b0e58");
  script_set_attribute(attribute:"see_also", value:"https://github.com/plone/volto/releases/tag/16.34.0");
  script_set_attribute(attribute:"see_also", value:"https://github.com/plone/volto/releases/tag/17.22.1");
  script_set_attribute(attribute:"see_also", value:"https://github.com/plone/volto/releases/tag/18.24.0");
  script_set_attribute(attribute:"see_also", value:"https://github.com/plone/volto/releases/tag/19.0.0-alpha.4");
  script_set_attribute(attribute:"see_also", value:"https://github.com/plone/volto/security/advisories/GHSA-xjhf-7833-3pm5");
  script_set_attribute(attribute:"see_also", value:"http://www.openwall.com/lists/oss-security/2025/08/28/3");
  script_set_attribute(attribute:"solution", value:
"Upgrade to @plone/volto version 16.34.0, 17.22.1, 18.24.0, 19.0.0-alpha.4 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-58047");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/08/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/08/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:nodejs:node.js");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nodejs_modules_win_installed.nbin", "nodejs_modules_linux_installed.nbin", "nodejs_modules_mac_installed.nbin");
  script_require_keys("Host/nodejs/modules/enumerated");

  exit(0);
}

include('vcf_extras_nodejs.inc');

get_kb_item_or_exit('Host/nodejs/modules/enumerated');

var app = '@plone/volto';
var app_info = vcf_extras::nodejs_modules::get_app_info(app:app);

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, app);

var constraints = [
  {'fixed_version': '16.34.0'},
  {'min_version': '17.0.0', 'fixed_version': '17.22.1'},
  {'min_version': '18.0.0', 'fixed_version': '18.24.0'},
  {'min_version': '19.0.0-alpha.1', 'fixed_version': '19.0.0-alpha.4'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);