Automated Logic WebCTRL Premium Server Unrestricted Upload of File with Dangerous Type (CVE-2024-8525)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502853);
  script_version("1.6");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/03/21");

  script_cve_id("CVE-2024-8525");
  script_xref(name:"ICSA", value:"24-326-01");

  script_name(english:"Automated Logic WebCTRL Premium Server Unrestricted Upload of File with Dangerous Type (CVE-2024-8525)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"CWE-434 Unrestricted Upload of File with Dangerous Type vulnerability exists which 
could allow an unauthenticated user to upload files of dangerous types without 
restrictions, leading to remote command execution.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.corporate.carrier.com/Images/CARR-PSA-2024-04-WebCTRL_Server_tcm558-245852.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?56a939f1");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-01");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Automated Logic has recommended the following:

- For CVE-2024-8525, a software update is available on the authorized dealer support site. Although a software update is
available for this issue, the last support date for v7.0 was 1/27/2023 and it is recommended that customers upgrade
their software to the latest supported version.
- For CVE-2024-8526, the vulnerability was fixed at version 8.0 for all impacted products.
- Additionally, Customers are encouraged to follow Automated Logic's [Security Best Practices Checklists for Building
Automation Systems (BAS)](https://www.automatedlogic.com/en/media/Security Best Practices for a WebCTRL v8.0
system-522_tcm702-168128.pdf) to ensure alignment with best practices installation guidelines.");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-8525");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(434);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/11/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/11/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/02/17");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:automatedlogic:sitescan_web");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Vertiv");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Vertiv');

var asset = tenable_ot::assets::get(vendor:'Vertiv');

var vuln_cpes = {
    "cpe:/a:automatedlogic:sitescan_web" :
        {"versionStartIncluding" : "7.0", "versionEndIncluding" : "7.0", "family" : "LiebertSiteScan"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);