VMware Cloud Foundation SDDC Manager Brotli Decoder Out-of-Bounds Write (VMSA-2026-0008)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(373652);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/29");

  script_cve_id("CVE-2026-111497");
  script_xref(name:"VMSA", value:"2026-0008");

  script_name(english:"VMware Cloud Foundation SDDC Manager Brotli Decoder Out-of-Bounds Write (VMSA-2026-0008)");

  script_set_attribute(attribute:"synopsis", value:
"A hybrid cloud platform on the remote host is affected by a remote code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of VMware Cloud Foundation SDDC Manager installed on the remote host is 5.2.x, 9.0.x, 9.1.0, or 9.1.1.
It is, therefore, affected by a remote code execution vulnerability in the Brotli decoder of its Node.js component as
referenced in the VMSA-2026-0008 advisory:

  - A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through
    1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory,
    disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a
    crafted Brotli-compressed stream. (CVE-2026-111497)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://knowledge.broadcom.com/external/article/460732");
  script_set_attribute(attribute:"see_also", value:"https://knowledge.broadcom.com/external/article/460734");
  # https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/39445
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b526b2b8");
  script_set_attribute(attribute:"solution", value:
"No patch is currently available. Apply the workaround described in VMware KB460732 (SDDC Manager 9.1.1) or KB460734
(SDDC Manager 5.2.x, 9.0.x, and 9.1.0).");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-111497");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/29");

  script_set_attribute(attribute:"potential_vulnerability", value:"true");
  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:vmware:cloud_foundation");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("vmware_cloud_foundation_installed.nbin", "vmware_cloud_foundation_web_detect.nbin");
  script_require_keys("installed_sw/VMware Cloud Foundation", "Settings/ParanoidReport");

  exit(0);
}

include('vdf.inc');

if (report_paranoia < 2) audit(AUDIT_PARANOID);

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'paranoia': true}}
  ],
  'checks': [
    {
      'product': {'name': 'VMware Cloud Foundation', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '5.2', 'max_version': '5.2.99999', 'fixed_display': 'See vendor advisory (workaround KB460734)'},
        {'min_version': '9.0', 'max_version': '9.0.99999', 'fixed_display': 'See vendor advisory (workaround KB460734)'},
        {'min_version': '9.1', 'max_version': '9.1.0.99999', 'fixed_display': 'See vendor advisory (workaround KB460734)'},
        {'min_version': '9.1.1', 'max_version': '9.1.1.99999', 'fixed_display': 'See vendor advisory (workaround KB460732)'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);