Spring Framework 5.3.x < 5.3.49 / 6.1.x < 6.1.28 / 6.2.x < 6.2.18.1 / 7.0.x < 7.0.7.1 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(320777);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/12");

  script_cve_id(
    "CVE-2026-41838",
    "CVE-2026-41839",
    "CVE-2026-41840",
    "CVE-2026-41841",
    "CVE-2026-41842",
    "CVE-2026-41843",
    "CVE-2026-41844",
    "CVE-2026-41845",
    "CVE-2026-41846",
    "CVE-2026-41848",
    "CVE-2026-41850",
    "CVE-2026-41851",
    "CVE-2026-41852",
    "CVE-2026-41853",
    "CVE-2026-41855"
  );
  script_xref(name:"IAVA", value:"2026-A-0562");

  script_name(english:"Spring Framework 5.3.x < 5.3.49 / 6.1.x < 6.1.28 / 6.2.x < 6.2.18.1 / 7.0.x < 7.0.7.1 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The Spring Framework install on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Spring Framework installed on the remote host is 5.3.x prior to 5.3.49, 6.1.x prior to 6.1.28, 6.2.x
prior to 6.2.18.1, or 7.0.x prior to 7.0.7.1. It is, therefore, affected by multiple vulnerabilities:

  - IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be
    possible to exploit in combination with inadequate authorization rules. (CVE-2026-41838)

  - Applications may be vulnerable to a Regular Expression Denial of Service (ReDoS) attack if an attacker is able to
    provide a pattern which is then directly or indirectly supplied to one of the following methods in AntPathMatcher:
    match, matchStart, extractUriTemplateVariables. (CVE-2026-41848)

  - In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and
    org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which
    can lead to unauthorized actions via gadget class deserialization. (CVE-2026-41855)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-41838");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-41839");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-41840");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-41841");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-41842");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-41843");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-41844");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-41845");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-41846");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-41848");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-41850");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-41851");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-41852");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-41853");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-41855");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Spring Framework version 5.3.49, 6.1.28, 6.2.18.1, or 7.0.7.1 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-41838");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-41855");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:pivotal_software:spring_framework");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:vmware:spring_framework");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("spring_jar_detection.nbin");
  script_require_keys("installed_sw/Spring Framework");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Spring Framework', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version':'5.3.0', 'fixed_version':'5.3.49'},
        {'min_version':'6.1.0', 'fixed_version':'6.1.28'},
        {'min_version':'6.2.0', 'fixed_version':'6.2.18.1', 'fixed_display':'6.2.18.1 / 6.2.19'},
        {'min_version':'7.0.0', 'fixed_version':'7.0.7.1', 'fixed_display':'7.0.7.1 / 7.0.8'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE, flags:{"xss":TRUE});
vdf::handle_check_and_report_errors(vdf_result:result);