RHEL 7 : xstream (Unpatched Vulnerability)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory xstream. The text
# itself is copyright (C) Red Hat, Inc.
##

include('compat.inc');

if (description)
{
  script_id(196408);
  script_version("1.0");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/05/11");

  script_cve_id(
    "CVE-2020-26258",
    "CVE-2020-26259",
    "CVE-2021-21341",
    "CVE-2021-21342",
    "CVE-2021-21343",
    "CVE-2021-21348",
    "CVE-2021-21349",
    "CVE-2021-21351",
    "CVE-2021-43859",
    "CVE-2022-40151"
  );

  script_name(english:"RHEL 7 : xstream (Unpatched Vulnerability)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Red Hat 7 host is affected by multiple vulnerabilities that will not be patched.");
  script_set_attribute(attribute:"description", value:
"The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple
vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - XStream: allow a remote attacker to load and execute arbitrary code from a remote host only by
    manipulating the processed input stream (CVE-2021-21351)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a
    Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow
    a remote attacker to request data from internal resources that are not publicly available only by
    manipulating the processed input stream. If you rely on XStream's default blacklist of the Security
    Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if
    running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security
    Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a
    whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still
    want to use XStream default blacklist can use a workaround described in more detailed in the referenced
    advisories. (CVE-2020-26258)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is
    vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow
    a remote attacker to delete arbitrary know files on the host as log as the executing process has
    sufficient rights only by manipulating the processed input stream. If you rely on XStream's default
    blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported
    vulnerability does not exist running Java 15 or higher. No user is affected, who followed the
    recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default
    blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of
    XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in
    more detailed in the referenced advisories. (CVE-2020-26259)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16,
    there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system
    depending on CPU type or parallel execution of such a payload resulting in a denial of service only by
    manipulating the processed input stream. No user is affected who followed the recommendation to setup
    XStream's security framework with a whitelist limited to the minimal required types. If you rely on
    XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
    (CVE-2021-21341)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16,
    there is a vulnerability where the processed stream at unmarshalling time contains type information to
    recreate the formerly written objects. XStream creates therefore new instances based on these type
    information. An attacker can manipulate the processed input stream and replace or inject objects, that
    result in a server-side forgery request. No user is affected, who followed the recommendation to setup
    XStream's security framework with a whitelist limited to the minimal required types. If you rely on
    XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
    (CVE-2021-21342)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16,
    there is a vulnerability where the processed stream at unmarshalling time contains type information to
    recreate the formerly written objects. XStream creates therefore new instances based on these type
    information. An attacker can manipulate the processed input stream and replace or inject objects, that
    result in the deletion of a file on the local host. No user is affected, who followed the recommendation
    to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely
    on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
    (CVE-2021-21343)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16,
    there is a vulnerability which may allow a remote attacker to occupy a thread that consumes maximum CPU
    time and will never return. No user is affected, who followed the recommendation to setup XStream's
    security framework with a whitelist limited to the minimal required types. If you rely on XStream's
    default blacklist of the Security Framework, you will have to use at least version 1.4.16.
    (CVE-2021-21348)

  - XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16,
    there is a vulnerability which may allow a remote attacker to request data from internal resources that
    are not publicly available only by manipulating the processed input stream. No user is affected, who
    followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal
    required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use
    at least version 1.4.16. (CVE-2021-21349)

  - XStream is an open source java library to serialize objects to XML and back again. Versions prior to
    1.4.19 may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or
    parallel execution of such a payload resulting in a denial of service only by manipulating the processed
    input stream. XStream 1.4.19 monitors and accumulates the time it takes to add elements to collections and
    throws an exception if a set threshold is exceeded. Users are advised to upgrade as soon as possible.
    Users unable to upgrade may set the NO_REFERENCE mode to prevent recursion. See GHSA-rmr5-cpv2-vgjf for
    further details on a workaround if an upgrade is not possible. (CVE-2021-43859)

  - Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the
    parser is running on user supplied input, an attacker may supply content that causes the parser to crash
    by stackoverflow. This effect may support a denial of service attack. (CVE-2022-40151)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package
is installed.");
  script_set_attribute(attribute:"solution", value:
"The vendor has acknowledged the vulnerabilities but no solution has been provided. Refer to the vendor for remediation
guidance.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-21351");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/12/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/05/11");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:7");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:xstream");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Red Hat Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl", "redhat_repos.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm.inc');
include('rhel.inc');

if (!get_kb_item("global_settings/vendor_unpatched"))
exit(0, "Unpatched Vulnerabilities Detection not active.");

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/RedHat/release');
if (isnull(os_release) || 'Red Hat' >!< os_release) audit(AUDIT_OS_NOT, 'Red Hat');
var os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'Red Hat');
os_ver = os_ver[1];
if (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '7')) audit(AUDIT_OS_NOT, 'Red Hat 7.x', 'Red Hat ' + os_ver);

if (!get_kb_item('Host/RedHat/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Red Hat', cpu);

var constraints = [
  {
    'pkgs': [
      {'reference':'xstream', 'release':'7', 'rpm_spec_vers_cmp':TRUE, 'unpatched_pkg':'xstream'}
    ]
  }
];


var flag = 0;
foreach var constraint_array ( constraints ) {
  var repo_relative_urls = NULL;
  var enterprise_linux_flag = rhel_repo_urls_has_content_dist_rhel(repo_urls:repo_relative_urls);
  foreach var pkg ( constraint_array['pkgs'] ) {
    var unpatched_pkg = NULL;
    var _release = NULL;
    var sp = NULL;
    var el_string = NULL;
    var rpm_spec_vers_cmp = NULL;
    var exists_check = NULL;
    var cves = NULL;
    if (!empty_or_null(pkg['unpatched_pkg'])) unpatched_pkg = pkg['unpatched_pkg'];
    if (!empty_or_null(pkg['release'])) _release = 'RHEL' + pkg['release'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (unpatched_pkg &&
        _release &&
        (!exists_check || rpm_exists(release:_release, rpm:exists_check)) &&
        unpatched_package_exists(release:_release, package:unpatched_pkg, cves: cves)) flag++;
  }
}

if (flag)
{
  var extra = NULL;
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : unpatched_packages_report()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'xstream');
}