Linux Distros Unpatched Vulnerability : CVE-2022-3704

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(232116);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/09/03");

  script_cve_id("CVE-2022-3704");

  script_name(english:"Linux Distros Unpatched Vulnerability : CVE-2022-3704");

  script_set_attribute(attribute:"synopsis", value:
"The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be
patched.");
  script_set_attribute(attribute:"description", value:
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied
patch available.

  - A vulnerability classified as problematic has been found in Ruby on Rails. This affects an unknown part of
    the file actionpack/lib/action_dispatch/middleware/templates/routes/_table.html.erb. The manipulation
    leads to cross site scripting. It is possible to initiate the attack remotely. The real existence of this
    vulnerability is still doubted at the moment. The name of the patch is
    be177e4566747b73ff63fd5f529fab564e475ed4. It is recommended to apply a patch to fix this issue. The
    associated identifier of this vulnerability is VDB-212319. NOTE: Maintainer declares that there isn't a
    valid attack vector. The issue was wrongly reported as a security vulnerability by a non-member of the
    Rails team. (CVE-2022-3704)

Note that Nessus relies on the presence of the package as reported by the vendor.");
  script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2022-3704");
  script_set_attribute(attribute:"solution", value:
"There is no known solution at this time.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2022-3704");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"vendor_unpatched", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/10/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/03/06");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:11.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:12.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:13.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:14.0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:rails");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("set_linux_os_id.nasl", "ssh_get_info2.nasl");
  script_require_keys("Host/OS/identifier", "Host/cpu", "Host/local_checks_enabled", "global_settings/vendor_unpatched");
  script_require_ports("Host/OS/Debian Linux-11", "Host/OS/Debian Linux-12", "Host/OS/Debian Linux-13", "Host/OS/Debian Linux-14");

  exit(0);
}

if (!get_kb_item("global_settings/vendor_unpatched")) exit(0, "Unpatched Vulnerabilities Detection not active.");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (empty_or_null(get_one_kb_item("Host/Debian/dpkg-l"))) audit(AUDIT_PACKAGE_LIST_MISSING);

include('linux_unpatched.inc');

var distro_constraints_array = {
  "Debian Linux-11": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "11",
        "pkgs": [
          {"reference": "rails"},
          {"reference": "ruby-actioncable"},
          {"reference": "ruby-actionmailbox"},
          {"reference": "ruby-actionmailer"},
          {"reference": "ruby-actionpack"},
          {"reference": "ruby-actiontext"},
          {"reference": "ruby-actionview"},
          {"reference": "ruby-activejob"},
          {"reference": "ruby-activemodel"},
          {"reference": "ruby-activerecord"},
          {"reference": "ruby-activestorage"},
          {"reference": "ruby-activesupport"},
          {"reference": "ruby-rails"},
          {"reference": "ruby-railties"}
        ]
      }
    ]
  },
  "Debian Linux-12": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "12",
        "pkgs": [
          {"reference": "rails"},
          {"reference": "ruby-actioncable"},
          {"reference": "ruby-actionmailbox"},
          {"reference": "ruby-actionmailer"},
          {"reference": "ruby-actionpack"},
          {"reference": "ruby-actiontext"},
          {"reference": "ruby-actionview"},
          {"reference": "ruby-activejob"},
          {"reference": "ruby-activemodel"},
          {"reference": "ruby-activerecord"},
          {"reference": "ruby-activestorage"},
          {"reference": "ruby-activesupport"},
          {"reference": "ruby-rails"},
          {"reference": "ruby-railties"}
        ]
      }
    ]
  },
  "Debian Linux-13": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "13",
        "pkgs": [
          {"reference": "rails"},
          {"reference": "ruby-actioncable"},
          {"reference": "ruby-actionmailbox"},
          {"reference": "ruby-actionmailer"},
          {"reference": "ruby-actionpack"},
          {"reference": "ruby-actiontext"},
          {"reference": "ruby-actionview"},
          {"reference": "ruby-activejob"},
          {"reference": "ruby-activemodel"},
          {"reference": "ruby-activerecord"},
          {"reference": "ruby-activestorage"},
          {"reference": "ruby-activesupport"},
          {"reference": "ruby-rails"},
          {"reference": "ruby-railties"}
        ]
      }
    ]
  },
  "Debian Linux-14": {
    "package_manager": "dpkg-l",
    "constraints": [
      {
        "release": "14",
        "pkgs": [
          {"reference": "rails"},
          {"reference": "ruby-actioncable"},
          {"reference": "ruby-actionmailbox"},
          {"reference": "ruby-actionmailer"},
          {"reference": "ruby-actionpack"},
          {"reference": "ruby-actiontext"},
          {"reference": "ruby-actionview"},
          {"reference": "ruby-activejob"},
          {"reference": "ruby-activemodel"},
          {"reference": "ruby-activerecord"},
          {"reference": "ruby-activestorage"},
          {"reference": "ruby-activesupport"},
          {"reference": "ruby-rails"},
          {"reference": "ruby-railties"}
        ]
      }
    ]
  }
};

var distro_constraints_values = linux_unpatched::get_distro_constraints(distro_constraints_arr:distro_constraints_array);
if (empty_or_null(distro_constraints_values)) audit(AUDIT_HOST_NOT, 'affected');
var report = linux_unpatched::check_unpatched_constraints(distro_constraints_values:distro_constraints_values);

if (!empty_or_null(report))
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : report
  );
  exit(0);
}
else
{
  audit(AUDIT_HOST_NOT, 'affected');
}