Visual Studio Tools for Applications Elevation of Privilege (CVE-2025-29803)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(276819);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/03");

  script_cve_id("CVE-2025-29803");
  script_xref(name:"IAVA", value:"2025-A-0247");

  script_name(english:"Visual Studio Tools for Applications Elevation of Privilege (CVE-2025-29803)");

  script_set_attribute(attribute:"synopsis", value:
"A Microsoft development toolset on the remote Windows host is affected by privilege escalation.");
  script_set_attribute(attribute:"description", value:
"In VSTA 2019 (prior 16.0.35907.0) and VSTA 2022 (prior to 17.0.35906.0), the software contains a vulnerability 
(CVE-2025-29803) that could allow remote or local attackers to execute arbitrary code or escalate privileges within 
the host application, potentially compromising systems that rely on VSTA for automation or extensibility.
  
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29803
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?961225e2");
  script_set_attribute(attribute:"solution", value:
"Upgrade to VSTA 16.0.35907.0, 17.0.35906.0 or later.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-29803");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/04/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/04/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/25");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:visual_studio_tools_for_applications");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("microsoft_visual_studio_tools_for_applications_win_installed.nbin");
  script_require_keys("installed_sw/Microsoft Visual Studio Tools for Applications", "SMB/Registry/Enumerated");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'windows'}}
  ],
  'checks': [
    {
      'product': {'name': 'Microsoft Visual Studio Tools for Applications', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        { 'min_version' : '16.0.0', 'fixed_version' : '16.0.35907.0'},
        { 'min_version' : '17.0.0', 'fixed_version' : '17.0.35906.0'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);