TencentOS Server 3: nodejs:22 (TSSA-2026:0921)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2026:0921.
##

include('compat.inc');

if (description)
{
  script_id(341129);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/27");

  script_cve_id(
    "CVE-2026-11822",
    "CVE-2026-11824",
    "CVE-2026-14257",
    "CVE-2026-69152",
    "CVE-2026-69192"
  );

  script_name(english:"TencentOS Server 3: nodejs:22 (TSSA-2026:0921)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 3 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0921 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-11822:
    SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension
    that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying
    a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in
    fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in
    fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an
    FTS5 MATCH query is executed against the malicious database.

    CVE-2026-11824:
    SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search
    extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database
    with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger
    an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH
    query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled
    with SQLITE_ENABLE_FTS5.

    CVE-2026-14257:
    brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand()
    function limits the number of results with a max option (default 100,000) but does not bound the length of
    each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit
    while making each result progressively longer, so total memory scales with both count and string length
    until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input
    ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced
    strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can
    be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds
    accumulated output and intermediate arrays.

    CVE-2026-69152:
    The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to
    1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative
    intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the
    event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions
    1.1.18, 2.1.4, 3.0.6, and 5.0.9.

    CVE-2026-69192:
    ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to
    10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG
    URL host parser, inet_aton, and getaddrinfo all decode a leading zero as octal. The library and the
    network stack therefore disagree about which host a string names. new Address4('012.0.0.1') reports
    correctForm() of 12.0.0.1 and isPrivate() of false, but fetch('http://012.0.0.1/') connects to 10.0.0.1.
    An application that builds a network trust-boundary decision on these checks, for example a filter
    intended to block Server-Side Request Forgery, or SSRF, will classify an internal target as external and
    allow the request. The defect is in the parse gate rather than in any one classifier, so every consumer of
    Address4 inherits it: isPrivate(), isLoopback(), isLinkLocal(), isCGNAT(), isInSubnet(), isHostInSubnet(),
    and correctForm() are all computed from the mis-decoded octets. This issue is fixed in version 10.3.1.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20260921.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-69192");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-11824");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-11824");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/27");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:nodejs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:nodejs-nodemon");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:nodejs-packaging");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^3([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 3.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '3',
    'pkgs': [
      {'reference':'nodejs-22.23.1-3.module+el8.10.0+956+0c6904cc', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'nodejs-22.23.1-3.module+el8.10.0+956+0c6904cc', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'nodejs-debuginfo-22.23.1-3.module+el8.10.0+956+0c6904cc', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'nodejs-debuginfo-22.23.1-3.module+el8.10.0+956+0c6904cc', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'nodejs-debugsource-22.23.1-3.module+el8.10.0+956+0c6904cc', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'nodejs-debugsource-22.23.1-3.module+el8.10.0+956+0c6904cc', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'nodejs-devel-22.23.1-3.module+el8.10.0+956+0c6904cc', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'nodejs-devel-22.23.1-3.module+el8.10.0+956+0c6904cc', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'nodejs-docs-22.23.1-3.module+el8.10.0+956+0c6904cc', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'nodejs-full-i18n-22.23.1-3.module+el8.10.0+956+0c6904cc', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'nodejs-full-i18n-22.23.1-3.module+el8.10.0+956+0c6904cc', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'nodejs-libs-22.23.1-3.module+el8.10.0+956+0c6904cc', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'nodejs-libs-22.23.1-3.module+el8.10.0+956+0c6904cc', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'nodejs-libs-debuginfo-22.23.1-3.module+el8.10.0+956+0c6904cc', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'nodejs-libs-debuginfo-22.23.1-3.module+el8.10.0+956+0c6904cc', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'nodejs-nodemon-3.1.14-2.module+el8.10.0+955+8168aeb7', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'nodejs-packaging-2021.06-6.module+el8.10.0+817+2499aee6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'nodejs-packaging-bundler-2021.06-6.module+el8.10.0+817+2499aee6', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'npm-10.9.8-1.22.23.1.3.module+el8.10.0+956+0c6904cc', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'npm-10.9.8-1.22.23.1.3.module+el8.10.0+956+0c6904cc', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'1'},
      {'reference':'v8-12.4-devel-12.4.254.21-1.22.23.1.3.module+el8.10.0+956+0c6904cc', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'},
      {'reference':'v8-12.4-devel-12.4.254.21-1.22.23.1.3.module+el8.10.0+956+0c6904cc', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'3'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'nodejs / nodejs-debuginfo / nodejs-debugsource / etc');
}