Twonky Server Writing of Arbitrary Files Vulnerability

# SPDX-FileCopyrightText: 2016 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:twonky:twonky_server";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.108006");
  script_version("2024-03-01T14:37:10+0000");
  script_tag(name:"last_modification", value:"2024-03-01 14:37:10 +0000 (Fri, 01 Mar 2024)");
  script_tag(name:"creation_date", value:"2016-09-27 12:00:00 +0200 (Tue, 27 Sep 2016)");
  script_tag(name:"cvss_base", value:"6.4");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:P/A:P");
  script_cve_id("CVE-2015-6505");
  script_name("Twonky Server Writing of Arbitrary Files Vulnerability");
  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2016 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("gb_twonky_server_detect.nasl");
  script_mandatory_keys("twonky_server/installed");

  script_xref(name:"URL", value:"https://docs.twonky.com/display/TRN/Twonky+Security+Advisory+1+(CVE-2015-6505)+-+Failure+to+verify+HTTP+parameter+allows+writing+of+arbitrary+files+on+host+running+Twonky+Server");
  script_xref(name:"URL", value:"https://docs.twonky.com/display/TRN/Twonky+Server+8.1.2");

  script_tag(name:"summary", value:"Twonky Server is prone to a vulnerability which permits attackers with access to the local network
  in which Twonky Server runs, to write arbitrary files on the host running the Twonky Server. It can be used to replace existing or
  create new files on the file system, as accessible by the user under which user ID Twonky Server runs (which can be root).");

  script_tag(name:"impact", value:"As this vulnerability can be used to overwrite and replace arbitrary files, this vulnerability can
  be used to gain control of the target system by overwriting system files or can create a denial of service attack by overwriting system
  critical files.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"affected", value:"All systems running Twonky Server versions 7.0.x, 8.0 and 8.1 with enabled NMC web API or web API.");

  script_tag(name:"solution", value:"Update your Twonky Server to a not vulnerable version 7.2.11/8.1.2

  Mitigation:

  Add the following configuration options to the Twonky Server configuration file:
  enablenmcwebapi=0
  enableweb=0

  This will block access to the incriminated function.
  NOTE: Setting 'enableweb' to '0' will completely disable HTTP web access to Twonky Server!");

  script_tag(name:"solution_type", value:"VendorFix");
  script_tag(name:"qod_type", value:"remote_banner");

  exit(0);
}

include("version_func.inc");
include("host_details.inc");

if( ! port = get_app_port( cpe:CPE ) )
  exit( 0 );

if( ! vers = get_app_version( cpe:CPE, port:port ) )
  exit( 0 );

if( version_in_range( version:vers, test_version:"7", test_version2:"7.2.10" ) ||
    version_in_range( version:vers, test_version:"8", test_version2:"8.1.1" ) ) {
  report = report_fixed_ver( installed_version:vers, fixed_version:"7.2.11/8.1.2" );
  security_message( port:port, data:report );
  exit( 0 );
}

exit( 99 );