Spring Framework 5.3.x < 5.3.48 / 6.1.x < 6.1.27 / 6.2.x < 6.2.18 / 7.0.x < 7.0.7 Multiple DoS

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(314917);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/18");

  script_cve_id("CVE-2026-22740", "CVE-2026-22741", "CVE-2026-22745");
  script_xref(name:"IAVA", value:"2026-A-0414");

  script_name(english:"Spring Framework 5.3.x < 5.3.48 / 6.1.x < 6.1.27 / 6.2.x < 6.2.18 / 7.0.x < 7.0.7 Multiple DoS");

  script_set_attribute(attribute:"synopsis", value:
"The Spring Framework install on the remote host is affected by multiple denial of service vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Spring Framework installed on the remote host is 5.3.x prior to 5.3.48, 6.1.x prior to 6.1.27, 6.2.x
prior to 6.2.18, or 7.0.x prior to 7.0.7. It is, therefore, affected by multiple vulnerabilities:

  - A WebFlux server application that processes multipart requests creates temp files for parts larger than 10K. Under
    some circumstances, temp files may remain not deleted after the request is fully processed, allowing an attacker to
    consume available disk space. (CVE-2026-22740)

  - Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources with caching
    and encoded resources resolution enabled. An attacker can poison the resource cache with resources using the wrong
    encoding, causing a denial of service. (CVE-2026-22741)

  - Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources from
    the file system on Windows platforms. An attacker can send malicious requests that are slow to resolve and that can
    keep HTTP connections in use. (CVE-2026-22745)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-22740");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-22741");
  # https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?781306b6");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-22745");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Spring Framework version 5.3.48, 6.1.27, 6.2.18, or 7.0.7 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-22745");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-22740");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:pivotal_software:spring_framework");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:vmware:spring_framework");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("spring_jar_detection.nbin");
  script_require_keys("installed_sw/Spring Framework");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Spring Framework', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version':'5.3.0', 'fixed_version':'5.3.48'},
        {'min_version':'6.1.0', 'fixed_version':'6.1.27'},
        {'min_version':'6.2.0', 'fixed_version':'6.2.18'},
        {'min_version':'7.0.0', 'fixed_version':'7.0.7'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);