TencentOS Server 4: storm (TSSA-2026:1037)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Tencent Linux Security Advisory TSSA-2026:1037.
##

include('compat.inc');

if (description)
{
  script_id(349546);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/23");

  script_cve_id(
    "CVE-2026-82426",
    "CVE-2026-82427",
    "CVE-2026-82431",
    "CVE-2026-82439",
    "CVE-2026-82441"
  );

  script_name(english:"TencentOS Server 4: storm (TSSA-2026:1037)");

  script_set_attribute(attribute:"synopsis", value:
"The remote TencentOS Server 4 host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is,
therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1037 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-82441:
    A submitted topology carries two lists of blobstore keys, dependency_jars and dependency_artifacts, which
    the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their
    contents on the submission path, yet acts on them in two places. During cleanup of a finished topology,
    Nimbus deletes the keys named in those lists as the Nimbus subject, for which the blobstore short-circuits
    its ACL check, allowing a submitter to delete blobs belonging to another topology. Separately, on
    acquiring leadership, Nimbus compares dependency keys of active topologies against blobstore contents and
    surrenders leadership if any is missing, causing the cluster to lose its leader indefinitely.

    CVE-2026-82439:
    The DRPC server kept a map from function name to request queue and created an entry the first time a
    function name was seen. No code path ever removed an entry, so the queue object and its map entry remained
    for the life of the process. Function names come from the client and are not constrained to registered
    functions, so the number of retained entries is bounded only by the number of distinct names an attacker
    sends, and each retained entry holds the name itself. drpc.authorizer is unset by default, so no
    credentials are required to reach the endpoint. The retained state is permanent, so the effect accumulates
    until the DRPC server exhausts its heap.

    CVE-2026-82431:
    SimpleACLAuthorizer evaluated the user-level command set by returning early when nimbus.users was empty,
    before nimbus.groups was considered. An operator who restricted cluster access by group alone, leaving
    nimbus.users unset, therefore received no restriction at all: every authenticated principal was permitted
    every user-level operation.

    CVE-2026-82427:
    A topology's topology.blobstore.map lets the submitter choose a local name for each blob that the
    supervisor localises. That name was used to build a path under the topology's working directory without
    normalisation, in both AsyncLocalizer and Container.createBlobstoreLinks, and the symlink helper force-
    deletes whatever already exists at the target before creating the link. A submitter could therefore use
    ../ segments to direct that delete-and-symlink operation at an arbitrary path, as the supervisor user, on
    every node the topology is scheduled onto.

    CVE-2026-82426:
    Nimbus accepted the uploadedJarLocation argument of submitTopology / submitTopologyWithOpts as a server-
    side path and opened it directly, without checking that it referred to a file the caller had actually
    uploaded. An authenticated user with topology submission rights could submit any path readable by the
    Nimbus daemon user as their topology jar, exposing files such as the Nimbus Kerberos keytab, TLS private
    keys, and storm.yaml.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://mirrors.tencent.com/tlinux/errata/tssa-20261037.xml");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-82439");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/23");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:tencent:tencentos_server:4");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:tencent:tencentos_server:storm");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tencent Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/etc/os-release", "Host/TencentOS/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'TencentOS' >!< os_product) audit(AUDIT_OS_NOT, 'TencentOS');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'TencentOS');
if (! preg(pattern:"^4([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'TencentOS 4.x', 'TencentOS ' + os_version);

if (!get_kb_item('Host/TencentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'TencentOS', cpu);

var constraints = [
  {
    'release': '4',
    'pkgs': [
      {'reference':'storm-3.1.0-1.tl4', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'storm-3.1.0-1.tl4', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'storm');
}