Splunk Enterprise and Universal Forwarder < 9.0 Improper Certificate Validation

##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(164078);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2022/11/16");

  script_cve_id("CVE-2022-32156");
  script_xref(name:"IAVA", value:"2022-A-0251-S");

  script_name(english:"Splunk Enterprise and Universal Forwarder < 9.0 Improper Certificate Validation");

  script_set_attribute(attribute:"synopsis", value:
"An application running on a remote web server host is affected by an improper certificate validation vulnerability.");
  script_set_attribute(attribute:"description", value:
"In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface (CLI) did not
validate TLS certificates while connecting to a remote Splunk platform instance by default. Splunk peer communications
configured properly with valid certificates were not vulnerable. However, connections from misconfigured nodes without
valid certificates did not fail by default.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.splunk.com/en_us/product-security/announcements/svd-2022-0606.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4d24490e");
  script_set_attribute(attribute:"solution", value:
"Upgrade Splunk Enterprise or Universal Forwarder to version 9.0 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-32156");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/06/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/06/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/08/11");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:splunk:splunk");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:splunk:universal_forwarder");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2022 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("splunk_web_detect.nasl", "splunkd_detect.nasl", "macos_splunk_installed.nbin", "splunk_win_installed.nbin", "splunk_nix_installed.nbin", "splunk_universal_forwarder_nix_installed.nbin", "splunk_universal_forwarder_win_installed.nbin");
  script_require_ports("installed_sw/Splunk", "installed_sw/Splunk Universal Forwarder");

  exit(0);
}

include('vcf_extras_splunk.inc');

var app_info = vcf::splunk::get_app_info();

var constraints = [
  { 'fixed_version': '9.0',  'license': 'Enterprise, Forwarder' }
];

vcf::splunk::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);