Apache Struts 6.0.0 <=> 6.10.0 / 7.0.0 <=> 7.2.1 Denial of Service (S2-073)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(338627);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/21");

  script_cve_id("CVE-2026-73634");
  script_xref(name:"IAVA", value:"2026-A-0858");

  script_name(english:"Apache Struts 6.0.0 <=> 6.10.0 / 7.0.0 <=> 7.2.1 Denial of Service (S2-073)");

  script_set_attribute(attribute:"synopsis", value:
"Apache Struts installed on the remote host is affected by Denial of Service vulnerability");
  script_set_attribute(attribute:"description", value:
"The version of Apache Struts installed on the remote host is 6.0.0 prior to 6.11.0, or 7.0.0 prior to 7.3.0. It is,
therefore, affected by a denial of service vulnerability as referenced in the S2-073 advisory.

  - Struts provides an optional facility for collecting Content Security Policy violation reports submitted by
    browsers. An application that exposes such a collection endpoint reads the submitted report into memory
    without bounding how much it will accept. A single request can therefore cause the server to allocate
    memory in proportion to the size of the request, exhausting the heap and denying service to other users.
    Endpoints of this kind are ordinarily reachable without authentication, because browsers submit to them
    directly. Unlike a plugin-specific issue, the affected facility ships as part of the Struts core. It is
    nevertheless inert until an application explicitly maps an endpoint to collect the reports: the core
    distribution maps no such endpoint by default, and enabling the Content Security Policy support alone does
    not expose one. Applications that do not collect violation reports are therefore not affected, whichever
    of the listed versions they run. (CVE-2026-73634)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://cwiki.apache.org/confluence/spaces/WW/pages/444334431/S2-073");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache Struts version 6.11.0 / 7.3.0 or later. Alternatively, apply the workaround as referenced in the
vendor's security bulletin.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-73634");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/21");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:struts");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("os_fingerprint.nasl", "struts_detect_win.nbin", "struts_detect_nix.nbin");
  script_require_keys("Host/OS", "Settings/ParanoidReport");
  script_require_ports("installed_sw/Apache Struts", "installed_sw/Struts");

  exit(0);
}

include('vcf.inc');

# Not checking if the application maps an endpoint to collect CSP violation reports
if (report_paranoia < 2) audit(AUDIT_PARANOID);

var os = get_kb_item_or_exit('Host/OS');
var win_local = ('windows' >< tolower(os));

var app_info = vcf::get_app_info(app:'Apache Struts', win_local:win_local);

vcf::check_granularity(app_info:app_info, sig_segments:3);

var constraints = [
  { 'min_version' : '6.0.0', 'fixed_version' : '6.11.0' },
  { 'min_version' : '7.0.0', 'fixed_version' : '7.3.0' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);