Qnap QTS Link Following (CVE-2021-44052)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502547);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/10/17");

  script_cve_id("CVE-2021-44052");

  script_name(english:"Qnap QTS Link Following (CVE-2021-44052)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"An improper link resolution before file access ('Link Following')
vulnerability has been reported to affect QNAP device running
QuTScloud, QuTS hero, and QTS. If exploited, this vulnerability allows
remote attackers to traverse the file system to unintended locations
and read or overwrite the contents of unexpected files. We have
already fixed this vulnerability in the following versions of
QuTScloud, QuTS hero, and QTS: QuTScloud c5.0.1.1998 and later QuTS
hero h4.5.4.1971 build 20220310 and later QuTS hero h5.0.0.1986 build
20220324 and later QTS 4.3.4.1976 build 20220303 and later QTS
4.3.3.1945 build 20220303 and later QTS 4.2.6 build 20220304 and later
QTS 4.3.6.1965 build 20220302 and later QTS 5.0.0.1986 build 20220324
and later QTS 4.5.4.1991 build 20220329 and later

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://www.qnap.com/en/security-advisory/qsa-22-16");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-44052");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(59);

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/05/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2022/05/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/10/16");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:5.0.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:4.5.4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:4.3.6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:4.3.4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:4.3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:4.2.6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h5.0.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:quts_hero:h4.5.4");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Qnap");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Qnap');

var asset = tenable_ot::assets::get(vendor:'Qnap');

var vuln_cpes = {
    "cpe:/o:qnap:qts:5.0.0" :
        {"versionStartIncluding" : "5.0.0", "versionEndExcluding" : "5.0.0.1986", "family" : "QTS"},
    "cpe:/o:qnap:qts:4.5.4" :
        {"versionStartIncluding" : "4.5.4", "versionEndExcluding" : "4.5.4.1991", "family" : "QTS"},
    "cpe:/o:qnap:qts:4.3.6" :
        {"versionStartIncluding" : "4.3.6", "versionEndExcluding" : "4.3.6.1965", "family" : "QTS"},
    "cpe:/o:qnap:qts:4.3.4" :
        {"versionStartIncluding" : "4.3.4", "versionEndExcluding" : "4.3.4.1976", "family" : "QTS"},
    "cpe:/o:qnap:qts:4.3.3" :
        {"versionStartIncluding" : "4.3.3", "versionEndExcluding" : "4.3.3.1945", "family" : "QTS"},
    "cpe:/o:qnap:qts:4.2.6" :
        {"versionStartIncluding" : "4.2.6", "versionEndIncluding" : "4.2.6", "family" : "QTS"},
    "cpe:/o:qnap:quts_hero:h5.0.0" :
        {"versionStartIncluding" : "h5.0.0", "versionEndExcluding" : "h5.0.0.1986", "family" : "QuTShero"},
    "cpe:/o:qnap:quts_hero:h4.5.4" :
        {"versionStartIncluding" : "h4.5.4", "versionEndExcluding" : "h4.5.4.1971", "family" : "QuTShero"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);