Apache Struts < 7.3.0 Multiple Vulnerabilities (S2-070) (S2-071)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338628);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/21");

  script_cve_id("CVE-2026-73631", "CVE-2026-73632");

  script_name(english:"Apache Struts < 7.3.0 Multiple Vulnerabilities (S2-070) (S2-071)");

  script_set_attribute(attribute:"synopsis", value:
"The Apache Struts install on the remote host is affected by multiple vulnerabilities in the JSON plugin.");
  script_set_attribute(attribute:"description", value:
"The version of Apache Struts installed on the remote host is 7.2.1. It is, therefore, affected by multiple
vulnerabilities in the JSON plugin, as referenced in the S2-070 and S2-071 advisories:

  - A component of the JSON plugin that holds per-request parsing state could be shared between concurrent
    requests instead of being used by a single request at a time. Because that state is not isolated, data
    associated with one request can become observable in another, and configured parsing limits may not be
    enforced as intended. Only the population of actions from a JSON request body is affected, which is not
    enabled by default. Applications that do not use the JSON plugin are not affected. (CVE-2026-73631)

  - A component of the JSON plugin that holds per-response serialization state could be shared between
    concurrent requests instead of being used by a single request at a time. Because that state is not
    isolated, response data associated with one request can become observable in another. Only the SMD /
    JSON-RPC handling of the JSON interceptor is affected, which is not enabled by default. The json result
    type is not affected, as a separate writer is used for each request. (CVE-2026-73632)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://cwiki.apache.org/confluence/spaces/WW/pages/444334417/S2-070");
  script_set_attribute(attribute:"see_also", value:"https://cwiki.apache.org/confluence/spaces/WW/pages/444334419/S2-071");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache Struts version 7.3.0 or later. Alternatively, for CVE-2026-73632, disable SMD support on the JSON
interceptor as referenced in the vendor's security bulletin.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-73631");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-73632");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/21");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:struts");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("os_fingerprint.nasl", "struts_detect_win.nbin", "struts_detect_nix.nbin");
  script_require_keys("Host/OS", "installed_sw/Apache Struts", "Settings/ParanoidReport");

  exit(0);
}

include('vcf.inc');

# Not checking if the JSON plugin is in use, nor if the affected non-default features are enabled
if (report_paranoia < 2) audit(AUDIT_PARANOID);

var os = get_kb_item_or_exit('Host/OS');
var win_local = ('windows' >< tolower(os));

var app_info = vcf::get_app_info(app:'Apache Struts', win_local:win_local);

vcf::check_granularity(app_info:app_info, sig_segments:3);

var constraints = [
  { 'equal' : '7.2.1', 'fixed_display' : '7.3.0' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);