SAP NetWeaver AS ABAP SSRF (3689080)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(302164);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/16");

  script_cve_id("CVE-2026-24316");
  script_xref(name:"IAVA", value:"2026-A-0215");

  script_name(english:"SAP NetWeaver AS ABAP SSRF (3689080)");

  script_set_attribute(attribute:"synopsis", value:
"The remote SAP NetWeaver ABAP server is affected by a server-side request forgery (SSRF) vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of SAP NetWeaver AS ABAP and ABAP Platform detected on the remote host is affected by a server-side 
request forgery (SSRF) vulnerability as referenced in the SAP Security Patch Day March 2026:

  - SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to 
    send HTTP requests to arbitrary internal or external endpoints. The report is therefore vulnerable to 
    Server-Side Request Forgery (SSRF). Successful exploitation could lead to interaction with potentially 
    sensitive internal endpoints, resulting in a low impact on data confidentiality and integrity. There is 
    no impact on availability of the application. (CVE-2026-24316)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://me.sap.com/notes/3689080");
  # https://support.sap.com/en/my-support/knowledge-base/security-notes-news/march-2026.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fd324094");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-24316");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/03/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/13");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:sap:netweaver_application_server");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("sap_netweaver_as_web_detect.nbin");
  script_require_keys("installed_sw/SAP Netweaver Application Server (AS)", "Settings/ParanoidReport");
  script_require_ports("Services/www", 80, 443, 8000, 50000);

  exit(0);
}

include('vcf_extras_sap.inc');

if (report_paranoia < 2) audit(AUDIT_PARANOID);

var app_info = vcf::sap_netweaver_as::get_app_info();

var fix = 'See vendor advisory';
var constraints = [
  {'equal' : '755', 'fixed_display' : fix },
  {'equal' : '756', 'fixed_display' : fix },
  {'equal' : '757', 'fixed_display' : fix },
  {'equal' : '758', 'fixed_display' : fix },
  {'equal' : '816', 'fixed_display' : fix },
  {'equal' : '918', 'fixed_display' : fix }
];

vcf::sap_netweaver_as::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_WARNING,
  abap:TRUE
);