ZenML < 0.56.2 Vulnerability - CVE-2024-2035

#%NASL_MIN_LEVEL 80900

##
# Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(213480);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/01/16");

  script_cve_id("CVE-2024-2035");

  script_name(english:"ZenML < 0.56.2 Vulnerability - CVE-2024-2035");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of ZenML installed on the remote host is prior to 0.56.2. It is, therefore, affected by 
An improper authorization vulnerability exists in the API /api/v1/users/id endpoint. This vulnerability 
allows any authenticated user to modify the information of other users, including changing the `active` 
status of user accounts to false, effectively deactivating them. The impact of this vulnerability is
significant as it allows for the deactivation of admin accounts, potentially disrupting the functionality and
security of the application.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.");
  script_set_attribute(attribute:"see_also", value:"https://huntr.com/bounties/1cfc6493-082e-4229-9f2f-496801a6557c");
  # https://github.com/zenml-io/zenml/commit/b95f083efffa56831cd41d8ed536aeb0b6038fa3
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?3d5824bb");
  script_set_attribute(attribute:"solution", value:
"Upgrade to ZenML version 0.56.2 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:M/C:N/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-2035");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(1220);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/06/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/06/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/01/03");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:zenml:zenml");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Artificial Intelligence");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("zenml_detect.nbin", "python_zenml_detect.nbin");
  script_require_keys("installed_sw/ZenML");

  exit(0);
}

include('vcf.inc');

var app_info = vcf::combined_get_app_info(app:'ZenML');
var constraints = [
    { 'min_version':'0.1', 'fixed_version':'0.56.2' },
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);