Spring Security 5.7 < 5.7.13 / 5.8 < 5.8.15 / 6.0 < 6.0.13 / 6.1 < 6.1.11 / 6.2 < 6.2.7 / 6.3 < 6.3.4 Authorization Bypass (CVE-2024-38821)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(210409);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/01/23");

  script_cve_id("CVE-2024-38821");

  script_name(english:"Spring Security 5.7 < 5.7.13 / 5.8 < 5.8.15 / 6.0 < 6.0.13 / 6.1 < 6.1.11 / 6.2 < 6.2.7 / 6.3 < 6.3.4 Authorization Bypass (CVE-2024-38821)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host contains a web application framework that is affected by an authorization bypass vulnerability.");
  script_set_attribute(attribute:"description", value:
"The remote host contains a Spring Security version that is 5.7 prior to 5.7.13, 5.8 prior to 5.8.15, 6.0 prior to
6.0.13, 6.1 prior to 6.1.11, 6.2 prior to 6.2.7, or 6.3 prior to 6.3.4. It may, therefore, be affected by an
authorization bypass vulnerability.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://spring.io/security/cve-2024-38821");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Spring Security version 5.7.13, 5.8.15, 6.0.13, 6.1.12, 6.2.7, or 6.3.4 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-38821");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/10/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/10/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/11/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:pivotal_software:spring_security");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2024-2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("pivotal_software_spring_security_installed.nbin");
  script_require_keys("installed_sw/Spring Security");

  exit(0);
}

include('vcf.inc');

var app_info =  vcf::get_app_info(app:'Spring Security');

var constraints = [
  { 'min_version':'5.7', 'fixed_version':'5.7.13' },
  { 'min_version':'5.8', 'fixed_version':'5.8.15' },
  { 'min_version':'6.0', 'fixed_version':'6.0.13' },
  { 'min_version':'6.1', 'fixed_version':'6.1.11' },
  { 'min_version':'6.2', 'fixed_version':'6.2.7' },
  { 'min_version':'6.3', 'fixed_version':'6.3.4' }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);