Synology Router Manager (SRM) 1.3.x Multiple Vulnerabilities (Synology-SA-24:03) - Unreliable Remote Version Check

# SPDX-FileCopyrightText: 2024 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:synology:router_manager";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.114422");
  script_version("2026-06-25T06:55:31+0000");
  script_tag(name:"last_modification", value:"2026-06-25 06:55:31 +0000 (Thu, 25 Jun 2026)");
  script_tag(name:"creation_date", value:"2024-03-12 15:01:11 +0000 (Tue, 12 Mar 2024)");
  script_tag(name:"cvss_base", value:"8.5");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:S/C:N/I:C/A:C");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2024-12-04 07:15:05 +0000 (Wed, 04 Dec 2024)");

  script_cve_id("CVE-2024-11398");

  script_tag(name:"qod_type", value:"remote_banner_unreliable");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Synology Router Manager (SRM) 1.3.x Multiple Vulnerabilities (Synology-SA-24:03) - Unreliable Remote Version Check");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2024 Greenbone AG");
  script_family("General");
  script_dependencies("gb_synology_srm_consolidation.nasl");
  script_mandatory_keys("synology/srm/detected");

  script_tag(name:"summary", value:"Synology Router Manager (SRM) is prone to multiple
  vulnerabilities.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"The following flaws exist:

  - CVE-2024-11398: Path traversal in the OTP reset functionality

  - No CVE: Unknown HTML code injection

  - No CVE: Unknown security constraints bypass");

  script_tag(name:"impact", value:"These vulnerabilities allow remote attackers or remote
  authenticated users to inject arbitrary web script or HTML, remote authenticated users to bypass
  security constraints, and remote authenticated users to read specific files.");

  script_tag(name:"affected", value:"SRM version 1.3.x prior to 1.3.1-9346-9.");

  script_tag(name:"solution", value:"Update to version 1.3.1-9346-9 or later.");

  script_xref(name:"URL", value:"https://www.synology.com/en-global/security/advisory/Synology_SA_24_03");

  exit(0);
}

include("host_details.inc");
include("revisions-lib.inc");
include("version_func.inc");

if (!version = get_app_version(cpe: CPE, nofork: TRUE))
  exit(0);

# nb: The patch level version cannot be obtained so when the fix is on a patch level version (e.g.
# 1.1.5-6542-4 and not 1.1.5-6542), there will be 2 VTs with different qod_type.
if (version =~ "^1\.3\.1-9346" && (revcomp(a: version, b: "1.3.1-9346-9" ) < 0)) {
  report = report_fixed_ver(installed_version: version, fixed_version: "1.3.1-9346-9");
  security_message(port: 0, data: report);
  exit(0);
}

# nb: This is checked by VT 1.3.6.1.4.1.25623.1.0.114421
if (version =~ "^1\.3" && (revcomp(a: version, b: "1.3.1-9346") < 0))
  exit(0);

exit(99);