Spring Framework < 5.2.26 / 5.3.x < 5.3.50 / 6.0.x < 6.0.31 / 6.1.x < 6.1.29 / 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(341189);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/28");

  script_cve_id(
    "CVE-2026-47886",
    "CVE-2026-47887",
    "CVE-2026-47891",
    "CVE-2026-47893",
    "CVE-2026-59280",
    "CVE-2026-59281"
  );
  script_xref(name:"IAVA", value:"2026-A-0898");

  script_name(english:"Spring Framework < 5.2.26 / 5.3.x < 5.3.50 / 6.0.x < 6.0.31 / 6.1.x < 6.1.29 / 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The Spring Framework install on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Spring Framework installed on the remote host is prior to 5.2.26, 5.3.x prior to 5.3.50, 6.0.x prior to
6.0.31, 6.1.x prior to 6.1.29, 6.2.x prior to 6.2.20, or 7.0.x prior to 7.0.8.1. It is, therefore, affected by multiple
vulnerabilities:

  - Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then
    render field errors using the no-argument Errors.getFieldErrors() or Errors.getFieldError() accessors are vulnerable
    to arbitrary HTML/JavaScript code injection, potentially resulting in a reflected cross-site scripting (XSS)
    vulnerability. (CVE-2026-59281)

  - Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial
    of Service (DoS) attack when the power operator is used with a BigDecimal or BigInteger operand and a large exponent
    value. Evaluation of such an expression can consume excessive CPU time and JVM heap memory, leading to application
    degradation or unavailability. (CVE-2026-47886)

  - Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a
    controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates
    through SpringTemplateLoader. Under these conditions, a view name containing backslash sequences can escape the
    configured template directory, potentially exposing files that should not be accessible. (CVE-2026-59280)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-47886");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-47887");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-47891");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-47893");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-59280");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-59281");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Spring Framework version 5.2.26 / 5.3.50 / 6.0.31 / 6.1.29 / 6.2.20 / 7.0.8.1 / 7.0.9 or later. Note that
some fixed releases are available to Enterprise Support customers only; refer to the vendor advisory for details.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-47891");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-47891");

  script_cwe_id(22, 79, 209, 400, 601, 770);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/28");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:pivotal_software:spring_framework");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:vmware:spring_framework");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("spring_jar_detection.nbin");
  script_require_keys("installed_sw/Spring Framework");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Spring Framework', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version':'5.2.26'},
        {'min_version':'5.3.0', 'fixed_version':'5.3.50'},
        {'min_version':'6.0.0', 'fixed_version':'6.0.31'},
        {'min_version':'6.1.0', 'fixed_version':'6.1.29'},
        {'min_version':'6.2.0', 'fixed_version':'6.2.20'},
        {'min_version':'7.0.0', 'fixed_version':'7.0.8.1', 'fixed_display':'7.0.8.1 / 7.0.9'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING, flags:{"xss":TRUE});
vdf::handle_check_and_report_errors(vdf_result:result);