Spring Framework < 5.2.20 / 5.3.x < 5.3.18 Remote Code Execution (CVE-2022-22965)

#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(159374);
  script_version("1.10");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/01/18");

  script_cve_id("CVE-2022-22965");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2022/04/25");

  script_name(english:"Spring Framework < 5.2.20 / 5.3.x < 5.3.18 Remote Code Execution (CVE-2022-22965)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host contains a web application framework library that is affected by a remote code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The remote host contains a Spring Framework library version that is prior to 5.2.20 or 5.3.x prior to 5.3.18. It is,
therefore, affected by a remote code execution vulnerability:

  - A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via
    data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application
    is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the
    nature of the vulnerability is more general, and there may be other ways to exploit it.

  - These are the prerequisites for the exploit:
    - JDK 9 or higher
    - Apache Tomcat as the Servlet container
    - Packaged as WAR
    - spring-webmvc or spring-webflux dependency

Note that users are required to enable the 'Show potential false alarms' setting, also known as paranoid mode, in their
scan policy in order to enable this plugin in a scan. In addition, the 'Perform thorough tests' setting must be enabled
as well.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://tanzu.vmware.com/security/cve-2022-22965");
  # https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?718f9ac3");
  # https://spring.io/blog/2022/04/01/spring-framework-rce-mitigation-alternative
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?2401ae46");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Spring Framework version 5.2.20 or 5.3.18 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-22965");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'Spring Framework Class property RCE (Spring4Shell)');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/03/31");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/03/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/03/31");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"requires_paranoid_scanning", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:pivotal_software:spring_framework");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:vmware:spring_framework");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2022-2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("spring_jar_detection.nbin", "tomcat_error_version.nasl", "tomcat_win_installed.nbin", "apache_tomcat_nix_installed.nbin", "java_jre_installed_unix.nbin", "java_jre_installed_win.nbin");
  script_require_keys("installed_sw/Spring Framework", "installed_sw/Apache Tomcat", "installed_sw/Java", "Settings/ParanoidReport");

  exit(0);
}

include('vcf.inc');
include('tomcat_version.inc');

var app_info = vcf::combined_get_app_info(app:'Spring Framework');

# A vuln version of Java must be installed for the exploit to work
var java_exit_message = 'A vulnerable version of Java is not installed. Spring Framework is, therefore, not vulnerable.';
var java_install_count = get_install_count(app_name:'Java', exit_if_zero:FALSE);
if (java_install_count < 1)
  exit(0, java_exit_message);
var java_installs = get_combined_installs(app_name:'Java');
if (java_installs[0] != IF_OK)
  exit(0, java_exit_message);

# JDK 9+ is vulnerable
# Exit if all detected Java installs are < 9
var vuln_java = FALSE;
foreach var java_install (java_installs[1])
{
  var java_version = str_replace(string:java_install.version, find:'_', replace:'.');
  if ( ver_compare(ver:java_version, fix:'1.9.0', strict:FALSE) >= 0 )
  {
    vuln_java = TRUE;
    break;
  }
}

if (!vuln_java)
  exit(0, java_exit_message);

# A "vulnerable" version of Tomcat must be installed for the exploit to work
var tomcat_exit_message = 'A vulnerable version of Apache Tomcat is not installed. Spring Framework is, therefore, not vulnerable.';
var tomcat_install_count = get_install_count(app_name:'Apache Tomcat', exit_if_zero:FALSE);
if (tomcat_install_count < 1)
  exit(0, tomcat_exit_message);
var tomcat_installs = get_combined_installs(app_name:'Apache Tomcat');
if (tomcat_installs[0] != IF_OK)
  exit(0, tomcat_exit_message);

# Tomcat 10.0.20, 9.0.62, and 8.5.78 are patched
# Exit if all detected Tomcat installs are patched
var vuln_tomcat = FALSE;
foreach var install (tomcat_installs[1])
{
  if (
    tomcat_ver_cmp(ver:install.version, fix:'10.0.20', same_branch:TRUE) < 0 ||
    tomcat_ver_cmp(ver:install.version, fix:'9.0.62', same_branch:TRUE) < 0 ||
    tomcat_ver_cmp(ver:install.version, fix:'8.5.78', same_branch:TRUE) < 0
  )
  {
    vuln_tomcat = TRUE;
    break;
  }
}

if (!vuln_tomcat)
  exit(0, tomcat_exit_message);

# Non-default configuration
if (report_paranoia < 2)  
  audit(AUDIT_PARANOID);

var constraints = [
  { 'fixed_version':'5.2.20' },
  { 'min_version':'5.3', 'fixed_version':'5.3.18' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);