Ruby REXML < 3.3.9 ReDoS vulnerability

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(210049);
  script_version("1.9");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/23");

  script_cve_id("CVE-2024-49761");
  script_xref(name:"IAVB", value:"2024-B-0163-S");

  script_name(english:"Ruby REXML < 3.3.9 ReDoS vulnerability");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has an application installed that is affected by information disclosure vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of the REXML Ruby library installed on the remote host is prior to 3.3.9. It is, therefore, affected by a
ReDoS vulnerability. The vulnerability lies when it parses an XML that has many digits between &# and x...; in a hex
numeric character reference (&#x...;). This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected 
maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/ruby/rexml/security/advisories/GHSA-2rxp-v6pw-ch6m");
  script_set_attribute(attribute:"solution", value:
"Upgrade to REXML version 3.3.9 or Ruby 3.2 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-49761");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/09/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/09/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/11/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ruby:rexml");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2024-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ruby_modules_nix_installed.nbin", "ruby_gem_modules_macos_installed.nbin", "ruby_modules_win_installed.nbin");
  script_require_keys("Host/ruby/modules/enumerated");

  exit(0);
}

include('ruby.inc');

// Ruby checks

var gem_name = 'rexml';
var app_info = ruby_gems::get_app_info(app: gem_name);

if (empty_or_null(app_info))
  audit(AUDIT_NOT_INST, gem_name);

vcf::check_all_backporting(app_info:app_info);

var constraints = [
  {'fixed_version': '3.3.9'}
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);