SAP NetWeaver AS Java Multiple Vulnerabilities (3700960)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(302113);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/16");

  script_cve_id("CVE-2025-9230", "CVE-2025-9232");
  script_xref(name:"IAVA", value:"2026-A-0215");

  script_name(english:"SAP NetWeaver AS Java Multiple Vulnerabilities (3700960)");

  script_set_attribute(attribute:"synopsis", value:
"The remote SAP NetWeaver AS Java server is affected by a multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of SAP NetWeaver Application Server Java detected on the remote host is affected by a affected 
by a multiple vulnerabilities as disclosed in the SAP Security Patch Day March 2026:

  - An application trying to decrypt CMS messages encrypted using password based encryption can trigger an 
    out-of-bounds read and write. This out-of-bounds read may trigger a crash which leads to Denial of 
    Service for an application. The out-of-bounds write can cause a memory corruption which can have various 
    consequences including a Denial of Service or Execution of attacker-supplied code. Although the 
    consequences of a successful exploit of this vulnerability could be severe, the probability that the 
    attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS 
    messages is very rarely used. (CVE-2025-9230)

  - An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 
    'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is 
    an IPv6 address. An out-of-bounds read can trigger a crash which leads to Denial of Service for an 
    application. The OpenSSL HTTP client API functions can be used directly by applications but they are also 
    used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in 
    OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In 
    this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability 
    requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user 
    has to have a 'no_proxy' environment variable set. (CVE-2025-9232)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://me.sap.com/notes/3700960");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-9230");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/30");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/03/13");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:sap:netweaver_application_server");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("sap_netweaver_as_web_detect.nbin");
  script_require_keys("installed_sw/SAP Netweaver Application Server (AS)", "Settings/ParanoidReport");
  script_require_ports("Services/www", 80, 443, 8000, 50000);

  exit(0);
}

include('vcf_extras_sap.inc');

if (report_paranoia < 2) audit(AUDIT_PARANOID);

var app_info = vcf::sap_netweaver_as::get_app_info();

var fix = 'See vendor advisory';
var constraints = [
  {'equal' : '7.50', 'fixed_display' : fix }
];

vcf::sap_netweaver_as::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE
);