SimpleHelp 5.5.x < 5.5.16 OIDC Authentication Bypass

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(333310);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/08");

  script_cve_id("CVE-2026-48558");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/07/02");

  script_name(english:"SimpleHelp 5.5.x < 5.5.16 OIDC Authentication Bypass");

  script_set_attribute(attribute:"synopsis", value:
"The SimpleHelp instance running on the remote host is affected by an authentication bypass vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of SimpleHelp running on the remote web server is 5.5.x prior to 5.5.16 (or a 6.0 pre-release prior to
6.0 RC2). It is, therefore, affected by an authentication bypass vulnerability in the OIDC authentication flow. When
OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their
cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token
containing arbitrary identity claims to obtain a fully authenticated technician session, allowing privileged
management activities such as remoting into managed endpoints and executing scripts. In some configurations this may
also allow a bypass of multi-factor authentication. No user interaction is required.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://simple-help.com/security/simplehelp-security-update-2026-05");
  # https://horizon3.ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d22b78d0");
  # https://blackpointcyber.com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3ee1e313");
  script_set_attribute(attribute:"solution", value:
"Upgrade to SimpleHelp version 5.5.16 / 6.0 RC2 or later to address this issue.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:A");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-48558");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"in_the_news", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/09");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/07");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"x-cpe:/a:simplehelp:simplehelp");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("simplehelp_webui_detect.nbin");
  script_require_keys("installed_sw/SimpleHelp", "Settings/ParanoidReport");

  exit(0);
}

include('vdf.inc');

# The vulnerability is only exploitable when OIDC authentication is configured, which cannot be
# confirmed remotely, so the check is gated behind paranoid reporting.
if (report_paranoia < 2) audit(AUDIT_PARANOID);
# CVE-2026-48558 affects 5.5.0 through 5.5.15 (fixed in 5.5.16) and 6.0 pre-release builds prior to 6.0 RC2.
# Only the 5.5.x branch is expressed here as pre-release 6.0 builds do not report a comparable release version.
# The vulnerability is only exploitable when OIDC authentication is configured, which cannot be confirmed
# remotely, so the check is gated behind paranoid reporting.
# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'paranoia': true}}
  ],
  'checks': [
    {
      'product': {'name': 'SimpleHelp', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '5.5', 'fixed_version': '5.5.16'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);