VMware Spring Boot < 2.5.15, 2.6.x < 2.6.15, 2.7.x < 2.7.12, 3.0.x < 3.0.7 DoS Vulnerability

# SPDX-FileCopyrightText: 2023 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:vmware:spring_boot";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.104758");
  script_version("2024-01-23T05:05:19+0000");
  script_tag(name:"last_modification", value:"2024-01-23 05:05:19 +0000 (Tue, 23 Jan 2024)");
  script_tag(name:"creation_date", value:"2023-05-22 12:56:49 +0000 (Mon, 22 May 2023)");
  script_tag(name:"cvss_base", value:"7.8");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:N/A:C");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2023-06-08 14:40:00 +0000 (Thu, 08 Jun 2023)");

  script_cve_id("CVE-2023-20883");

  script_name("VMware Spring Boot < 2.5.15, 2.6.x < 2.6.15, 2.7.x < 2.7.12, 3.0.x < 3.0.7 DoS Vulnerability");
  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2023 Greenbone AG");
  script_family("Denial of Service");
  script_dependencies("gb_vmware_spring_boot_consolidation.nasl");
  script_mandatory_keys("vmware/spring/boot/detected");

  script_xref(name:"URL", value:"https://spring.io/security/cve-2023-20883");
  script_xref(name:"URL", value:"https://spring.io/blog/2023/05/18/spring-boot-2-5-15-and-2-6-15-available-now");
  script_xref(name:"URL", value:"https://spring.io/blog/2023/05/18/spring-boot-2-7-12-available-now");
  script_xref(name:"URL", value:"https://spring.io/blog/2023/05/18/spring-boot-3-0-7-available-now");

  script_tag(name:"summary", value:"VMware Spring Boot is prone to a denial of service (DoS)
  vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"There is potential for a DoS attack if Spring MVC is used
  together with a reverse proxy cache.");

  script_tag(name:"affected", value:"VMware Spring Boot versions prior to 2.5.15, 2.6.x prior to
  2.6.15, 2.7.x prior to 2.7.12 and 3.0.x prior to 3.0.7.

  Specifically, an application is vulnerable if all of the conditions are true:

  - The application has Spring MVC auto-configuration enabled. This is the case by default if Spring
  MVC is on the classpath.

  - The application makes use of Spring Boot's welcome page support, either static or templated.

  - Your application is deployed behind a proxy which caches 404 responses.

  Your application is NOT vulnerable if any of the following are true:

  - Spring MVC auto-configuration is disabled. This is true if WebMvcAutoConfiguration is explicitly
  excluded, if Spring MVC is not on the classpath, or if spring.main.web-application-type is set to
  a value other than SERVLET.

  - The application does not use Spring Boot's welcome page support.

  - You do not have a proxy which caches 404 responses.");

  script_tag(name:"solution", value:"Update to version 2.5.15, 2.6.15, 2.7.12, 3.0.7 or later.

  Workarounds: configure the reverse proxy not to cache 404 responses and/or not to cache responses
  to requests to the root (/) of the application.");

  # nb: See affected tag for specific constraints / requirements for being vulnerable.
  script_tag(name:"qod_type", value:"executable_version_unreliable");
  script_tag(name:"solution_type", value:"VendorFix");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if( isnull( port = get_app_port( cpe:CPE ) ) )
  exit( 0 );

if( ! infos = get_app_version_and_location( cpe:CPE, port:port, exit_no_version:TRUE ) )
  exit( 0 );

version = infos["version"];
location = infos["location"];

if( version_is_less( version:version, test_version:"2.5.15" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"2.5.15 / 2.6.15 / 2.7.12 / 3.0.7", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

if( version_in_range_exclusive( version:version, test_version_lo:"2.6.0", test_version_up:"2.6.15" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"2.6.15 / 2.7.12 / 3.0.7", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

if( version_in_range_exclusive( version:version, test_version_lo:"2.7.0", test_version_up:"2.7.12" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"2.7.12 / 3.0.7", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

if( version_in_range_exclusive( version:version, test_version_lo:"3.0.0", test_version_up:"3.0.7" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"3.0.7", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

exit( 99 );