Cisco NX-OS Software Python Parser Privilege Escalation (CVE-2019-1727)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(501266);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2023/07/26");

  script_cve_id("CVE-2019-1727");

  script_name(english:"Cisco NX-OS Software Python Parser Privilege Escalation (CVE-2019-1727)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability in the Python scripting subsystem of Cisco NX-OS
Software could allow an authenticated, local attacker to escape the
Python parser and issue arbitrary commands to elevate the attacker's
privilege level. The vulnerability is due to insufficient sanitization
of user-supplied parameters that are passed to certain Python
functions in the scripting sandbox of the affected device. An attacker
could exploit this vulnerability to escape the scripting sandbox and
execute arbitrary commands to elevate the attacker's privilege level.
To exploit this vulnerability, the attacker must have local access and
be authenticated to the targeted device with administrative or Python
execution privileges. These requirements could limit the possibility
of a successful exploit.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/bid/108341");
  # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-pyth-escal
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4760bae3");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-1727");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(78);

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/05/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/05/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/07/25");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:7");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:cisco:nx-os:8");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2023 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Cisco");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Cisco');

var asset = tenable_ot::assets::get(vendor:'Cisco');

var vuln_cpes = {
    "cpe:/o:cisco:nx-os:8.1%281b%29" :
        {"versionEndExcluding" : "8.1%281b%29", "versionStartIncluding" : "5.2", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:7.0%283%29i4%288%29" :
        {"versionEndExcluding" : "7.0%283%29i4%288%29", "versionStartIncluding" : "7.0%283%29i4", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:7.0%283%29i7%283%29" :
        {"versionEndExcluding" : "7.0%283%29i7%283%29", "versionStartIncluding" : "7.0%283%29i5", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:7.3%284%29n1%281%29" :
        {"versionEndExcluding" : "7.3%284%29n1%281%29", "versionStartIncluding" : "7.3", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:7.3%283%29d1%281%29" :
        {"versionEndExcluding" : "7.3%283%29d1%281%29", "versionStartIncluding" : "6.2", "family" : "NXOS"},
    "cpe:/o:cisco:nx-os:8.3%281%29" :
        {"versionEndExcluding" : "8.3%281%29", "versionStartIncluding" : "8.0", "family" : "NXOS"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);