Elastic Kibana 'CVE-2017-11499' DoS Vulnerability - Windows

# SPDX-FileCopyrightText: 2018 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:elastic:kibana";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.108366");
  script_version("2025-09-03T14:11:39+0000");
  script_cve_id("CVE-2017-11499");
  script_tag(name:"cvss_base", value:"5.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_tag(name:"last_modification", value:"2025-09-03 14:11:39 +0000 (Wed, 03 Sep 2025)");
  script_tag(name:"severity_vector", value:"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2017-12-07 02:29:00 +0000 (Thu, 07 Dec 2017)");
  script_tag(name:"creation_date", value:"2018-03-02 11:39:35 +0100 (Fri, 02 Mar 2018)");
  script_name("Elastic Kibana 'CVE-2017-11499' DoS Vulnerability - Windows");
  script_copyright("Copyright (C) 2018 Greenbone AG");
  script_category(ACT_GATHER_INFO);
  script_family("Denial of Service");
  script_dependencies("gb_elastic_kibana_http_detect.nasl", "os_detection.nasl");
  script_mandatory_keys("elastic/kibana/detected", "Host/runs_windows");

  script_xref(name:"URL", value:"https://www.elastic.co/community/security");

  script_tag(name:"summary", value:"Elastic Kibana is shipping a version of Node.js which is prone
  to a denial of service (DoS) vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"impact", value:"This flaw could allow a remote attacker to consume resources
  within Node.js preventing Kibana from servicing requests.");

  script_tag(name:"affected", value:"Elastic Kibana versions prior to 4.6.5 and 5.x prior to 5.5.1.");

  script_tag(name:"solution", value:"Administrators running Kibana in an environment with untrusted
  users should update to version 5.5.1 or 4.6.5. There is no workaround for this issue, the flaw can
  be triggered by an unauthenticated anonymous user.");

  script_tag(name:"solution_type", value:"VendorFix");
  script_tag(name:"qod_type", value:"remote_banner");

  exit(0);
}

include("version_func.inc");
include("host_details.inc");

if( ! port = get_app_port( cpe:CPE ) )
  exit( 0 );

if( ! vers = get_app_version( cpe:CPE, port:port ) )
  exit( 0 );

if( version_is_less( version:vers, test_version:"4.6.5" ) ) {
  fix  = "4.6.5";
  VULN = TRUE;
} else if( vers =~ "^5\." && version_is_less( version:vers, test_version:"5.5.1" ) ) {
  fix  = "5.5.1";
  VULN = TRUE;
}

if( VULN ) {
  report = report_fixed_ver( installed_version:vers, fixed_version:fix );
  security_message( port:port, data:report );
  exit( 0 );
}

exit( 99 );