Qnap QTS OS Command Injection (CVE-2023-39300)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502494);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/10/17");

  script_cve_id("CVE-2023-39300");

  script_name(english:"Qnap QTS OS Command Injection (CVE-2023-39300)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"An OS command injection vulnerability has been reported to affect
legacy QTS. If exploited, the vulnerability could allow authenticated
administrators to execute commands via a network. We have already
fixed the vulnerability in the following versions: QTS 4.3.6.2805
build 20240619 and later QTS 4.3.4.2814 build 20240618 and later QTS
4.3.3.2784 build 20240619 and later QTS 4.2.6 build 20240618 and later

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://www.qnap.com/en/security-advisory/qsa-24-26");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-39300");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(78);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/09/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/09/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/10/16");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:4.3.6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:4.3.4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:4.3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:qnap:qts:4.2.6");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Qnap");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Qnap');

var asset = tenable_ot::assets::get(vendor:'Qnap');

var vuln_cpes = {
    "cpe:/o:qnap:qts:4.3.6" :
        {"versionStartIncluding" : "4.3.6", "versionEndExcluding" : "4.3.6.2805", "family" : "QTS"},
    "cpe:/o:qnap:qts:4.3.4" :
        {"versionStartIncluding" : "4.3.4", "versionEndExcluding" : "4.3.4.2814", "family" : "QTS"},
    "cpe:/o:qnap:qts:4.3.3" :
        {"versionStartIncluding" : "4.3.3", "versionEndExcluding" : "4.3.3.2784", "family" : "QTS"},
    "cpe:/o:qnap:qts:4.2.6" :
        {"versionStartIncluding" : "4.2.6", "versionEndIncluding" : "4.2.6", "family" : "QTS"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);