Apache Commons Net < 3.9.0 Information Disclosure Vulnerability

# SPDX-FileCopyrightText: 2022 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:apache:commons_net";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.104451");
  script_version("2023-10-18T05:05:17+0000");
  script_tag(name:"last_modification", value:"2023-10-18 05:05:17 +0000 (Wed, 18 Oct 2023)");
  script_tag(name:"creation_date", value:"2022-12-05 11:28:28 +0000 (Mon, 05 Dec 2022)");
  script_tag(name:"cvss_base", value:"7.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:C/I:N/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2022-12-06 13:01:00 +0000 (Tue, 06 Dec 2022)");

  script_cve_id("CVE-2021-37533");

  script_tag(name:"qod_type", value:"executable_version_unreliable");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Apache Commons Net < 3.9.0 Information Disclosure Vulnerability");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2022 Greenbone AG");
  script_family("General");
  script_dependencies("gb_apache_commons_consolidation.nasl");
  script_mandatory_keys("apache/commons/net/detected");

  script_tag(name:"summary", value:"The Apache Commons Net library is prone to an information
  disclosure vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"Net's FTP client trusts the host from PASV response by default.
  A malicious server can redirect the Commons Net code to use a different host, but the user has to
  connect to the malicious server in the first place. This may lead to leakage of information about
  services running on the private network of the client.

  The default in version 3.9.0 is now false to ignore such hosts, as cURL does. See [link moved to
  references].");

  script_tag(name:"affected", value:"Applications using the FTP client of the Apache Commons Net library
  in versions prior to 3.9.0.");

  script_tag(name:"solution", value:"Update to version 3.9.0 or later.");

  script_xref(name:"URL", value:"https://lists.apache.org/thread/o6yn9r9x6s94v97264hmgol1sf48mvx7");
  script_xref(name:"URL", value:"https://issues.apache.org/jira/browse/NET-711");
  script_xref(name:"URL", value:"http://www.openwall.com/lists/oss-security/2022/12/03/1");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_is_less(version: version, test_version: "3.9.0")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "3.9.0", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);