ZenML < 0.55.5 Vulnerability - CVE-2024-2032

#%NASL_MIN_LEVEL 80900

##
# Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(213482);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/01/16");

  script_cve_id("CVE-2024-2032");

  script_name(english:"ZenML < 0.55.5 Vulnerability - CVE-2024-2032");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of ZenML installed on the remote host is prior to 0.55.5. It is, therefore, affected by a
race condition vulnerability which allows for the creation of multiple users with the same username when 
requests are sent in parallel. The vulnerability arises due to insufficient handling of concurrent user creation requests,
leading to data inconsistencies and potential authentication problems. Specifically, concurrent processes may
overwrite or corrupt user data, complicating user identification and posing security risks. This issue is
particularly concerning for APIs that rely on usernames as input parameters, such as PUT
/api/v1/users/test_race, where it could lead to further complications.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.");
  # https://github.com/zenml-io/zenml/commit/afcaf741ef9114c9b32f722f101b97de3d8d147b
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b254cad2");
  script_set_attribute(attribute:"see_also", value:"https://huntr.com/bounties/6199cd5d-611f-4ea9-96c5-52a952ba5a56");
  script_set_attribute(attribute:"solution", value:
"Upgrade to ZenML version 0.55.5 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:M/C:N/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-2032");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(362, 366);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/06/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/06/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/01/03");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:zenml:zenml");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Artificial Intelligence");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("zenml_detect.nbin", "python_zenml_detect.nbin");
  script_require_keys("installed_sw/ZenML");

  exit(0);
}

include('vcf.inc');

var app_info = vcf::combined_get_app_info(app:'ZenML');
var constraints = [
    { 'min_version':'0.1', 'max_version': '0.55.3', 'fixed_version':'0.55.5' },
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_NOTE);