Apache Tomcat 9.0.0.M1 < 9.0.106 multiple vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(240060);
  script_version("1.8");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id(
    "CVE-2025-48976",
    "CVE-2025-48988",
    "CVE-2025-49124",
    "CVE-2025-49125",
    "CVE-2025-55668"
  );
  script_xref(name:"IAVA", value:"2025-A-0437-S");
  script_xref(name:"IAVA", value:"2025-A-0582-S");

  script_name(english:"Apache Tomcat 9.0.0.M1 < 9.0.106 multiple vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote Apache Tomcat server is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The version of Tomcat installed on the remote host is prior to 9.0.106. It is, therefore, affected by multiple
vulnerabilities as referenced in the fixed_in_apache_tomcat_9.0.106_security-9 advisory.

  - Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the
    Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache
    Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105. The
    following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through
    8.5.100 and 7.0.95 through 7.0.109. Users are recommended to upgrade to version 11.0.8, 10.1.42 or
    9.0.106, which fix the issue. (CVE-2025-49124)

  - Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from
    11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL
    versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106,
    which fix the issue. (CVE-2025-55668)

  - Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using
    PreResources or PostResources mounted other than at the root of the web application, it was possible to
    access those resources via an unexpected path. That path was likely not to be protected by the same
    security constraints as the expected path, allowing those security constraints to be bypassed. This issue
    affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1
    through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be
    affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to
    upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue. (CVE-2025-49125)

  - Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects
    Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through
    9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected:
    8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to
    version 11.0.8, 10.1.42 or 9.0.106, which fix the issue. (CVE-2025-48988)

  - Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in
    Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from
    2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the
    issue. (CVE-2025-48976)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://github.com/apache/tomcat/commit/9418e3ff9f1f4c006b4661311ae9376c52d162b9
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?27b9f847");
  # https://github.com/apache/tomcat/commit/28726cc2e63bed68771f5eb0f65a78dc7080571823
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?be545bd7");
  # https://github.com/apache/tomcat/commit/9c3673ba04009377cb0c81ccb6cf5078aec1aa95
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?beb90a44");
  # https://github.com/apache/tomcat/commit/ee8042ffce4cb9324dfd79efda5984f37bbb6910
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e9db66bb");
  # https://github.com/apache/tomcat/commit/97790a35a27d236fa053e660676c3f8196284d93
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c3212d83");
  # https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.106
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?6fc9fd89");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Apache Tomcat version 9.0.106 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-55668");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2025-49124");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2025-48988");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/06/09");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/06/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/06/16");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:tomcat:9");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("os_fingerprint.nasl", "tomcat_error_version.nasl", "tomcat_win_installed.nbin", "apache_tomcat_nix_installed.nbin");
  script_require_keys("installed_sw/Apache Tomcat");

  exit(0);
}

include('vcf_extras.inc');

vcf::tomcat::initialize();
var app_info = vcf::combined_get_app_info(app:'Apache Tomcat');

var constraints = [
  { 'min_version' : '9.0.0.M1', 'max_version' : '9.0.105', 'fixed_version' : '9.0.106' }
];

vcf::check_all_backporting(app_info:app_info);
vcf::check_granularity(app_info:app_info, sig_segments:3);
vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_HOLE
);