Cisco NX-OS Improper Encoding or Escaping of Output (CVE-2017-12340)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502723);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/16");

  script_cve_id("CVE-2017-12340");

  script_name(english:"Cisco NX-OS Improper Encoding or Escaping of Output (CVE-2017-12340)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in Cisco NX-OS System Software running on Cisco MDS
Multilayer Director Switches, Cisco Nexus 7000 Series Switches, and
Cisco Nexus 7700 Series Switches could allow an authenticated, local
attacker to access the Bash shell of an affected device's operating
system, even if the Bash shell is disabled on the system. The
vulnerability is due to insufficient sanitization of user-supplied
parameters that are passed to certain functions of the Python
scripting sandbox of the affected system. An attacker could exploit
this vulnerability to escape the scripting sandbox and enter the Bash
shell of the operating system with the privileges of the authenticated
user for the affected system. To exploit this vulnerability, the
attacker must have local access to the affected system and be
authenticated to the affected system with administrative or Python
execution privileges. Cisco Bug IDs: CSCvd86513.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/102069");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-switch
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d942a1f3");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/102069");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-switch
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d942a1f3");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-12340");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(116, 284);

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/11/30");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/11/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/12/04");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nexus_7000_series_switches");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024-2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:nexus_7000_series_switches" :
        {"versionEndExcluding" : "8.1%282%29", "family" : "NXOS"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);