Telerik UI for ASP.NET AJAX 2008.3.1314 < 2026.2.708 RadEditor PDF Export SSRF

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(351483);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/30");

  script_cve_id("CVE-2026-13192");
  script_xref(name:"IAVA", value:"2026-A-0763");

  script_name(english:"Telerik UI for ASP.NET AJAX 2008.3.1314 < 2026.2.708 RadEditor PDF Export SSRF");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has a web application development framework that is affected by a server-side request forgery
vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Progress Telerik UI for ASP.NET AJAX installed on the remote Windows host is 2008.3.1314 or later and
prior to 2026.2.708. It is, therefore, affected by a server-side request forgery vulnerability. Insufficient validation
of content submitted to the RadEditor PDF export feature may allow an authenticated attacker to trigger server-side
requests to arbitrary hosts, resulting in outbound network connections and potential exposure of Windows authentication
credentials.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-radeditor-pdf-export-ssrf-cve-2026-13192
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5487e08b");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Progress Telerik UI for ASP.NET AJAX version 2026.2.708 (2026 Q2 SP1) or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-13192");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/30");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:telerik:ui_for_asp.net_ajax");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("telerik_ui_for_aspnet_ajax_installed.nbin");
  script_require_keys("installed_sw/Telerik UI for ASP.NET AJAX", "Settings/ParanoidReport");

  exit(0);
}

include('vdf.inc');

# The advisory documents configuration preconditions and workarounds that cannot be checked.
if (report_paranoia < 2) audit(AUDIT_PARANOID);

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'windows'}}
  ],
  'checks': [
    {
      'product': {'name': 'Telerik UI for ASP.NET AJAX', 'type': 'app'},
      'check_algorithm': 'default',
      'potential_vulnerability': {
        'missing_config_check': true
      },
      'requires': [
        {'scope': 'target', 'match': {'paranoia': true}}
      ],
      'constraints': [
        {'min_version': '2008.3.1314', 'fixed_version': '2026.2.708'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);