Telerik UI for ASP.NET AJAX 2009.1.314 < 2026.2.708 LayoutBuilder XXE DoS

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(351480);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/30");

  script_cve_id("CVE-2026-14865");

  script_name(english:"Telerik UI for ASP.NET AJAX 2009.1.314 < 2026.2.708 LayoutBuilder XXE DoS");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has a web application development framework that is affected by a denial of service vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Progress Telerik UI for ASP.NET AJAX installed on the remote Windows host is 2009.1.314 or later and
prior to 2026.2.708. It is, therefore, affected by a denial of service vulnerability. The internal LayoutBuilder control
processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML
entity expansion.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.telerik.com/products/aspnet-ajax/documentation/knowledge-base/kb-security-rlb-xxe-injection-client-state-cve-2026-14865
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8be98339");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Progress Telerik UI for ASP.NET AJAX version 2026.2.708 (2026 Q2 SP1) or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-14865");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/22");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/22");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/30");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:telerik:ui_for_asp.net_ajax");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("telerik_ui_for_aspnet_ajax_installed.nbin");
  script_require_keys("installed_sw/Telerik UI for ASP.NET AJAX", "Settings/ParanoidReport");

  exit(0);
}

include('vdf.inc');

# The advisory documents configuration preconditions and workarounds that cannot be checked.
if (report_paranoia < 2) audit(AUDIT_PARANOID);

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'windows'}}
  ],
  'checks': [
    {
      'product': {'name': 'Telerik UI for ASP.NET AJAX', 'type': 'app'},
      'check_algorithm': 'default',
      'potential_vulnerability': {
        'missing_config_check': true
      },
      'requires': [
        {'scope': 'target', 'match': {'paranoia': true}}
      ],
      'constraints': [
        {'min_version': '2009.1.314', 'fixed_version': '2026.2.708'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);