Qnap QTS Path Traversal (CVE-2018-19945)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502508);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/10/17");

  script_cve_id("CVE-2018-19945");

  script_name(english:"Qnap QTS Path Traversal (CVE-2018-19945)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A vulnerability has been reported to affect earlier QNAP devices
running QTS 4.3.4 to 4.3.6. Caused by improper limitations of a
pathname to a restricted directory, this vulnerability allows for
renaming arbitrary files on the target system, if exploited. QNAP have
already fixed this vulnerability in the following versions: QTS
4.3.6.0895 build 20190328 (and later) QTS 4.3.4.0899 build 20190322
(and later) This issue does not affect QTS 4.4.x or QTS 4.5.x.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://www.qnap.com/zh-tw/security-advisory/qsa-20-21");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-19945");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(20, 22, 284, 73);

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/12/31");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/12/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/10/16");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:4.3.6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:4.3.4");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Qnap");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Qnap');

var asset = tenable_ot::assets::get(vendor:'Qnap');

var vuln_cpes = {
    "cpe:/o:qnap:qts:4.3.6" :
        {"versionStartIncluding" : "4.3.6", "versionEndExcluding" : "4.3.6.0895", "family" : "QTS"},
    "cpe:/o:qnap:qts:4.3.4" :
        {"versionStartIncluding" : "4.3.4", "versionEndExcluding" : "4.3.4.0899", "family" : "QTS"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);