Python Library jupyter_core < 5.8.0 Uncontrolled Search Path

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(237906);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/06/06");

  script_cve_id("CVE-2025-30167");
  script_xref(name:"IAVB", value:"2025-B-0089");

  script_name(english:"Python Library jupyter_core < 5.8.0 Uncontrolled Search Path");

  script_set_attribute(attribute:"synopsis", value:
"A Python library installed on the remote Windows host is affected by an uncontrolled search path vulnerability.");
  script_set_attribute(attribute:"description", value:
"The detected version of the Python package, jupyter_core, is prior to 5.8.0. It is, therefore, affected by a
vulnerability, as explained in the GHSA-33p9-3p43-82vq advisory. Jupyter Core is a package for the core common
functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared `%PROGRAMDATA%`
directory is searched for configuration files (`SYSTEM_CONFIG_PATH` and `SYSTEM_JUPYTER_PATH`), which may allow users to
create configuration files affecting other users. Only shared Windows systems with multiple users and unprotected
`%PROGRAMDATA%` are affected. Users should upgrade to Jupyter Core version 5.8.0 or later to receive a patch. Some other
mitigations are available. As administrator, modify the permissions on the `%PROGRAMDATA%` directory so it is not
writable by unauthorized users; or as administrator, create the `%PROGRAMDATA%\jupyter` directory with appropriately
restrictive permissions; or as user or administrator, set the `%PROGRAMDATA%` environment variable to a directory with
appropriately restrictive permissions (e.g. controlled by administrators or the current user).

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://github.com/jupyter/jupyter_core/security/advisories/GHSA-33p9-3p43-82vq
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9b493be7");
  script_set_attribute(attribute:"solution", value:
"Upgrade to jupyter_core version 5.8.0 or later. However, version 5.8.1 is recommended by the advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-30167");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/05/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/05/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/06/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:jupyter:jupyter_core");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("python_packages_win_installed.nbin");
  script_require_keys("SMB/Registry/Enumerated", "Host/win/Python/Packages/Enumerated");

  exit(0);
}

include('vcf.inc');
include('python.inc');

if (!get_kb_item('SMB/Registry/Enumerated'))
  audit(AUDIT_OS_NOT, 'Windows');

var os = 'win';
var os_pkg = NULL;
var pkg = 'jupyter_core';

var found_lib, libs = [];

found_lib = python::query_python_package(os:os, pkg_name:pkg);

dbg::detailed_log(
  lvl: 1,
  msg: 'Found python lib',
  msg_details: {
    'found_lib': {'lvl': 1, 'value': found_lib}});

if (!empty_or_null(found_lib))
  foreach (var found in found_lib)
  {
    found.pkg_name = pkg;
    append_element(var:libs, value:found);
  }

if (empty_or_null(libs))
  audit(AUDIT_HOST_NOT, 'affected');

var lib = branch(libs);
var lib_info = {
  'app' : lib.pkg_name,
  'version' : lib.version,
  'display_version' : lib.version,
  'parsed_version' : vcf::parse_version(lib.version),
  'path' : lib.path + '/' + lib.pkg_name
};

var constraints = [
  { 'fixed_version' : '5.8.0', 'fixed_display' : '5.8.0 (5.8.1 recommended)' }
];

vcf::check_version_and_report(app_info:lib_info, constraints:constraints, severity:SECURITY_WARNING);