ZenML < 0.57.0 Password Reset Brute Force (CVE-2024-4311)

#%NASL_MIN_LEVEL 80900

##
# Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(213484);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/05/08");

  script_cve_id("CVE-2024-4311");

  script_name(english:"ZenML < 0.57.0 Password Reset Brute Force (CVE-2024-4311)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by a 
  password reset brute force vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of ZenML installed on the remote host is prior to 0.57.0. It is, therefore, affected by an account takeover
exposure due to the lack of rate-limiting in the password change function. An attacker can brute-force the current 
password in the 'Update Password' function, allowing them to take over the user's account. This vulnerability is due to 
the absence of rate-limiting on the '/api/v1/current-user' endpoint, which does not restrict the number of attempts 
an attacker can make to guess the current password. Successful exploitation results in the attacker being able to 
change the password and take control of the account.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.");
  # https://github.com/zenml-io/zenml/commit/87a6c2c8f45b49ea83fbb5fe8fff7ab5365a60c9
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f6d8adcd");
  script_set_attribute(attribute:"see_also", value:"https://huntr.com/bounties/d5517e1a-6b94-4e38-aad6-3aa65f98bec2");
  script_set_attribute(attribute:"solution", value:
"Upgrade to ZenML version 0.57.0 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:S/C:P/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-4311");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_cwe_id(770);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/11/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/11/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/01/03");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:zenml:zenml");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Artificial Intelligence");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("zenml_detect.nbin", "python_zenml_detect.nbin");
  script_require_keys("installed_sw/ZenML");

  exit(0);
}

include('vcf.inc');

var app_info = vcf::combined_get_app_info(app:'ZenML');
var constraints = [
    { 'min_version':'0.1', 'fixed_version':'0.57.0' },
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);