Plesk Detection (HTTP)

# SPDX-FileCopyrightText: 2013 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.103740");
  script_version("2023-10-24T05:06:28+0000");
  script_tag(name:"last_modification", value:"2023-10-24 05:06:28 +0000 (Tue, 24 Oct 2023)");
  script_tag(name:"creation_date", value:"2013-06-17 16:27:41 +0200 (Mon, 17 Jun 2013)");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:N/A:N");
  script_tag(name:"cvss_base", value:"0.0");

  script_tag(name:"qod_type", value:"remote_banner");

  script_name("Plesk Detection (HTTP)");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2013 Greenbone AG");
  script_family("Product detection");
  script_dependencies("find_service.nasl", "httpver.nasl", "global_settings.nasl");
  script_require_ports("Services/www", 8443);
  script_exclude_keys("Settings/disable_cgi_scanning");

  script_tag(name:"summary", value:"HTTP based detection of Plesk.");

  script_xref(name:"URL", value:"https://www.plesk.com/");

  exit(0);
}

include("http_func.inc");
include("http_keepalive.inc");
include("port_service_func.inc");
include("cpe.inc");
include("host_details.inc");

port = http_get_port( default:8443 );

url1 = "/login_up.php3";
res1 = http_get_cache( item:url1, port:port );

url2 = "/";
res2 = http_get_cache( item:url2, port:port );

# nb: Even recent versions seems to still support the ".php3" from above, we're still checking
# both just to be sure / future proof.
url3 = "/login_up.php";
res3 = http_get_cache( item:url3, port:port );

banner = http_get_remote_headers( port:port );

detection_patterns = make_list(
  # <title>Plesk Onyx 17.8.11</title>
  # <title>Plesk Obsidian 18.0.45</title>
  # <title>Plesk 12.0.18</title>
  # <title>SomeName Pleask</title>
  "<title>(Parallels Plesk|Plesk( (Onyx|Obsidian))?)",
  # <meta name="plesk-build" content="20230919.08">
  # <meta name="plesk-build" content="1708180301.19">
  # <meta name="plesk-build" content="1800220722.09">
  # <meta name="plesk-build" content="20200325.22">
  'name="plesk-build"',
  # <meta name="plesk-revision" content="a92d12c5b2a2a5e42268d42eadd56c0794432012">
  # <meta name="plesk-revision" content="">
  # nb: Seems to only available in 18.x onward
  'name="plesk-revision"',
  # X-Powered-By: PleskLin
  # X-Powered-By-Plesk: PleskWin
  # X-Powered-By: PleskWin
  # nb: Using two different ones for separate reporting
  "^X-Powered-By\s*:\s*Plesk[LW]in",
  "^X-Powered-By-Plesk\s*:\s*Plesk[LW]in",
  # <p>This page is generated by <a href="http://www.plesk.com" target="_blank">Plesk</a>, the leading hosting automation software. You see this page because there is no Web site at this address.</p>
  # <p>This page is generated by <a href="http://www.parallels.com/products/panel/intro">Parallels Plesk</a>, the leading hosting automation software. You see this page because there is no Web site at this address.</p>
  "This page is generated by <[^>]+>(Parallels )?Plesk</a>" );

found = 0;
concluded = ""; # nb: To make openvas-nasl-lint happy...

foreach pattern( detection_patterns ) {

  # nb: Only for the banner
  if( "X-Powered-By" >< pattern ) {
    concl = egrep( string:banner, pattern:pattern, icase:TRUE );
  }

  # nb: For the default page only available on "/"
  else if( "This page is generated by" >< pattern ) {
    if( res2 !~ "^HTTP/1\.[01] 200" )
      continue;

    concl = egrep( string:res2, pattern:pattern, icase:FALSE );
  }

  # nb: For the default page only available on "/login_up.php3" and/or "/login_up.php"
  else {
    if( res1 !~ "^HTTP/1\.[01] 200" && res3 !~ "^HTTP/1\.[01] 200" )
      continue;

    if( res1 =~ "^HTTP/1\.[01] 200" )
      concl = egrep( string:res1, pattern:pattern, icase:FALSE );
    else
      concl = egrep( string:res3, pattern:pattern, icase:FALSE );
  }

  if( concl ) {

    found++;

    if( concluded )
      concluded += '\n';

    # nb: Minor formatting change for the reporting.
    concl = chomp( concl );
    concl = ereg_replace( string:concl, pattern:"^(\s+)", replace:"" );
    concluded += "  " + concl;
  }
}

if( found > 0 ) {

  version = "unknown";
  install = "/";

  if( res1 =~ "^HTTP/1\.[01] 200" ) {

    vers = eregmatch( pattern:"<title>(Parallels Plesk( Panel)?|Plesk( (Onyx|Obsidian))?) ([0-9.]+)", string:res1 );
    if( ! isnull( vers[5] ) ) {
      conclUrl = http_report_vuln_url( port:port, url:url1, url_only:TRUE );
      version = vers[5];
      # nb: No need to add this to the "concluded" string as the title tag is already included there...
    } else {
      # "urlArgs":"18.0.24"
      # "urlArgs":"17.8.11-95"
      vers = eregmatch( pattern:'"urlArgs":"([0-9.]+)', string:res1 );
      if( ! isnull( vers[1] ) ) {
        conclUrl = http_report_vuln_url( port:port, url:url1, url_only:TRUE );
        version = vers[1];
        concluded += '\n' + "  " + vers[0];
      }
    }
  }

  if( version == "unknown" ) {
    if( res3 =~ "^HTTP/1\.[01] 200" ) {

      vers = eregmatch( pattern:"<title>(Parallels Plesk( Panel)?|Plesk( (Onyx|Obsidian))?) ([0-9.]+)", string:res3 );
      if( ! isnull( vers[5] ) ) {
        conclUrl = http_report_vuln_url( port:port, url:url3, url_only:TRUE );
        version = vers[5];
        # nb: No need to add this to the "concluded" string as the title tag is already included there...
      } else {
        # "urlArgs":"18.0.24"
        # "urlArgs":"17.8.11-95"
        # "urlArgs":"18.0.54"
        vers = eregmatch( pattern:'"urlArgs":"([0-9.]+)', string:res3 );
        if( ! isnull( vers[1] ) ) {
          conclUrl = http_report_vuln_url( port:port, url:url3, url_only:TRUE );
          version = vers[1];
          concluded += '\n' + "  " + vers[0];
        }
      }
    }
  }

  set_kb_item( name:"plesk/detected", value:TRUE );
  set_kb_item( name:"plesk/http/detected", value:TRUE );

  base_cpe = "cpe:/a:parallels:parallels_plesk_panel";

  if( ! isnull( vers[4] ) || version =~ "^1[78]\." ) {
    if( version =~ "^17\." || vers[4] == "Onyx" )
      base_cpe = "cpe:/a:plesk:onyx";
    else
      base_cpe = "cpe:/a:plesk:obsidian";

    rel = " " + vers[4];
  }

  cpe = build_cpe( value:version, exp:"^([0-9.]+)", base:base_cpe + ":" );
  if( ! cpe )
    cpe = base_cpe;

  register_product( cpe:cpe, location:install, port:port, service:"www" );

  log_message( data:build_detection_report( app:"Plesk" + rel,
                                            version:version,
                                            install:install,
                                            cpe:cpe,
                                            concludedUrl:conclUrl,
                                            concluded:concluded ),
               port:port );
}

exit( 0 );