Spring Framework < 5.2.26 / 5.3.x < 5.3.50 / 6.0.x < 6.0.31 / 6.1.x < 6.1.29 / 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 Response Splitting

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(358453);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/02");

  script_cve_id("CVE-2026-59314");

  script_name(english:"Spring Framework < 5.2.26 / 5.3.x < 5.3.50 / 6.0.x < 6.0.31 / 6.1.x < 6.1.29 / 6.2.x < 6.2.20 / 7.0.x < 7.0.8.1 Response Splitting");

  script_set_attribute(attribute:"synopsis", value:
"The Spring Framework install on the remote host is affected by an HTTP response splitting vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Spring Framework installed on the remote host is prior to 5.2.26, 5.3.x prior to 5.3.50, 6.0.x prior to
6.0.31, 6.1.x prior to 6.1.29, 6.2.x prior to 6.2.20, or 7.0.x prior to 7.0.8.1. It is, therefore, affected by a
vulnerability:

  - Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response
    splitting when the input is a malicious file name. An attacker who controls content disposition values can break
    the HTTP header, or corrupt the framing of an outbound multipart body. (CVE-2026-59314)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2026-59314");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Spring Framework version 5.2.26 / 5.3.50 / 6.0.31 / 6.1.29 / 6.2.20 / 7.0.8.1 / 7.0.9 or later. Note that
some fixed releases are available to Enterprise Support customers only; refer to the vendor advisory for details.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-59314");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(113);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/01");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:pivotal_software:spring_framework");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:vmware:spring_framework");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("spring_jar_detection.nbin");
  script_require_keys("installed_sw/Spring Framework");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Spring Framework', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version':'5.2.26'},
        {'min_version':'5.3.0', 'fixed_version':'5.3.50'},
        {'min_version':'6.0.0', 'fixed_version':'6.0.31'},
        {'min_version':'6.1.0', 'fixed_version':'6.1.29'},
        {'min_version':'6.2.0', 'fixed_version':'6.2.20'},
        {'min_version':'7.0.0', 'fixed_version':'7.0.8.1', 'fixed_display':'7.0.8.1 / 7.0.9'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_NOTE);
vdf::handle_check_and_report_errors(vdf_result:result);