Progress OpenEdge 12.2.x < 12.2.18 / 12.8.x < 12.8.9 RCE (000288507)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(265971);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/09/26");

  script_cve_id("CVE-2025-7388");
  script_xref(name:"IAVA", value:"2025-A-0694");

  script_name(english:"Progress OpenEdge 12.2.x < 12.2.18 / 12.8.x < 12.8.9 RCE (000288507)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Progress OpenEdge installed on the remote host is 12.2.x prior to 12.2.18, or 12.8.x prior to 12.8.9. It
is, therefore, affected by a remote code execution vulnerability as referenced in the 000288507 advisory.

  - It was possible to perform Remote Command Execution (RCE) via Java RMI interface in the OpenEdge
    AdminServer, allowing authenticated users to inject and execute OS commands under the delegated authority
    of the AdminServer process.  An RMI interface permitted manipulation of a configuration property with
    inadequate input validation leading to OS command injection. (CVE-2025-7388)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://community.progress.com/s/article/Important-RCE-Security-Update-for-OpenEdge-AdminServer
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f3a834c1");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Progress OpenEdge version 12.2.18 / 12.8.9 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-7388");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/04");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/09/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:progress:openedge");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("progress_openedge_win_installed.nbin");
  script_require_keys("SMB/Registry/Enumerated", "installed_sw/Progress OpenEdge");

  exit(0);
}

include('vcf.inc');
include('lists.inc');

# progress_openedge_nix_installed.nbin is not capable of detecting the specific components
get_kb_item_or_exit('SMB/Registry/Enumerated');

var app_info = vcf::get_app_info(app:'Progress OpenEdge', win_local:TRUE);

var vulnerable_products = [
  # Products that require AdminServer to be installed
  # https://docs.progress.com/bundle/openedge-management-introduction-122/page/OpenEdge-products-supported-by-the-AdminServer.html
  'OE Personal RDBMS',
  'OE Workgroup RDBMS',
  'OE Enterprise RDBMS',
  'OE Adv. Ent. RDBMS',
  'OE DataServer MS SQL S',
  'OE DataServer MS SQL Svr',
  'OE DataServer for Oracle',
  'OE Application Svr Bas',
  'OE Application Svr Ent',
  'OE Studio',
  'Progress Dev Studio OE',
  'AppServer IntAdap',
  'NameServer',
  'OE Development Server',
  'NameServer Load Balance',
  'WebSpeed Workshop',
  'OpenEdge Replication',
  'OpenEdge Repl Plus',
  '4GL Development System',
  'OpenEdge Mgt. SE',
  'OpenEdge JMS Adapter'
];

var installed_vulnerable = collib::intersection(keys(app_info), vulnerable_products);

if (empty_or_null(installed_vulnerable))
  vcf::audit(app_info);

var constraints = [
  { 'min_version' : '12.2', 'fixed_version' : '12.2.18' },
  { 'min_version' : '12.8', 'fixed_version' : '12.8.9' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);