Qnap QTS Command Injection (CVE-2020-2509)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502506);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/10/17");

  script_cve_id("CVE-2020-2509");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2022/05/02");

  script_name(english:"Qnap QTS Command Injection (CVE-2020-2509)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A command injection vulnerability has been reported to affect QTS and
QuTS hero. If exploited, this vulnerability allows attackers to
execute arbitrary commands in a compromised application. We have
already fixed this vulnerability in the following versions: QTS
4.5.2.1566 Build 20210202 and later QTS 4.5.1.1495 Build 20201123 and
later QTS 4.3.6.1620 Build 20210322 and later QTS 4.3.4.1632 Build
20210324 and later QTS 4.3.3.1624 Build 20210416 and later QTS 4.2.6
Build 20210327 and later QuTS hero h4.5.1.1491 build 20201119 and
later

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://www.qnap.com/en/security-advisory/qsa-21-05");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-2509");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(77, 78);

  script_set_attribute(attribute:"vuln_publication_date", value:"2021/04/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2021/04/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/10/16");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:4.5.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:4.5.1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:4.3.6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:4.3.4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:4.3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:4.2.6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h4.5.1");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Qnap");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Qnap');

var asset = tenable_ot::assets::get(vendor:'Qnap');

var vuln_cpes = {
    "cpe:/o:qnap:qts:4.5.2" :
        {"versionStartIncluding" : "4.5.2", "versionEndExcluding" : "4.5.2.1566", "family" : "QTS"},
    "cpe:/o:qnap:qts:4.5.1" :
        {"versionStartIncluding" : "4.5.1", "versionEndExcluding" : "4.5.1.1495", "family" : "QTS"},
    "cpe:/o:qnap:qts:4.3.6" :
        {"versionStartIncluding" : "4.3.6", "versionEndExcluding" : "4.3.6.1620", "family" : "QTS"},
    "cpe:/o:qnap:qts:4.3.4" :
        {"versionStartIncluding" : "4.3.4", "versionEndExcluding" : "4.3.4.1632", "family" : "QTS"},
    "cpe:/o:qnap:qts:4.3.3" :
        {"versionStartIncluding" : "4.3.3", "versionEndExcluding" : "4.3.3.1624", "family" : "QTS"},
    "cpe:/o:qnap:qts:4.2.6" :
        {"versionStartIncluding" : "4.2.6", "versionEndIncluding" : "4.2.6", "family" : "QTS"},
    "cpe:/o:qnap:quts_hero:h4.5.1" :
        {"versionStartIncluding" : "h4.5.1", "versionEndExcluding" : "h4.5.1.1491", "family" : "QuTShero"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);