SSL/TLS: Renegotiation MITM Vulnerability (CVE-2009-3555)

# SPDX-FileCopyrightText: 2021 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.117758");
  script_version("2026-03-13T05:54:58+0000");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:M/Au:N/C:N/I:P/A:P");
  script_tag(name:"cvss_base", value:"5.8");
  script_tag(name:"last_modification", value:"2026-03-13 05:54:58 +0000 (Fri, 13 Mar 2026)");
  script_tag(name:"creation_date", value:"2021-10-28 11:04:54 +0000 (Thu, 28 Oct 2021)");
  script_cve_id("CVE-2009-3555");
  script_name("SSL/TLS: Renegotiation MITM Vulnerability (CVE-2009-3555)");
  script_category(ACT_ATTACK); # nb: Might be already seen as an attack by remote systems.
  script_family("SSL and TLS");
  script_copyright("Copyright (C) 2021 Greenbone AG");
  script_dependencies("gb_ssl_tls_sni_supported.nasl", "gb_ssl_tls_version_get.nasl",
                      "gb_starttls_pop3.nasl", "gb_starttls_imap.nasl",
                      "gb_starttls_ftp.nasl", "gb_starttls_smtp.nasl",
                      "gb_postgresql_tls_support.nasl", "gb_starttls_ldap.nasl",
                      "gb_starttls_nntp.nasl", "gb_starttls_xmpp.nasl", "gb_starttls_mysql.nasl",
                      "gb_starttls_irc.nasl", "gb_starttls_rdp.nasl",
                      "gb_ssl_tls_secure_renegotiation_supported.nasl");
  script_mandatory_keys("ssl_tls/port", "ssl_tls/safe_secure_renegotiation/checked");

  script_xref(name:"URL", value:"https://blog.g-sec.lu/2009/11/tls-sslv3-renegotiation-vulnerability.html");
  script_xref(name:"URL", value:"https://www.g-sec.lu/practicaltls.pdf");
  script_xref(name:"URL", value:"https://www.kb.cert.org/vuls/id/120541");
  script_xref(name:"URL", value:"https://orchilles.com/ssl-renegotiation-dos/");
  script_xref(name:"URL", value:"https://lwn.net/Articles/362234/");
  script_xref(name:"URL", value:"https://kb.fortinet.com/kb/documentLink.do?externalID=FD36385");
  script_xref(name:"URL", value:"https://datatracker.ietf.org/doc/html/rfc5746");
  script_xref(name:"URL", value:"https://mailarchive.ietf.org/arch/msg/tls/Y1O3HUcq9T94rMLCGPTTozURtSI/");

  script_tag(name:"summary", value:"The remote SSL/TLS service is prone to a man-in-the-middle
  (MITM) vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if the remote service allows to re-do the same SSL/TLS
  handshake (Renegotiation) over an existing / already established SSL/TLS connection.");

  script_tag(name:"insight", value:"The flaw exists because the remote SSL/TLS service does not
  properly associate renegotiation handshakes with an existing connection, which allows MITM
  attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by
  TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a
  post-renegotiation context, related to a 'plaintext injection' attack, aka the 'Project Mogul'
  issue.");

  script_tag(name:"impact", value:"A remote, unauthenticated attacker may be able to inject an
  arbitrary amount of chosen plaintext into the beginning of the application protocol stream. This
  could allow and attacker to issue HTTP requests, or take action impersonating the user, among
  other consequences.");

  script_tag(name:"affected", value:"The TLS protocol, and the SSL protocol 3.0 and possibly
  earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP
  Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network
  Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products.");

  script_tag(name:"solution", value:"Users should contact their vendors for specific patch
  information.

  General solution options are:

  - remove/disable renegotiation capabilities altogether from/in the affected SSL/TLS service

  - enable Safe/Secure renegotiation (RFC5746) for the affected SSL/TLS service");

  script_tag(name:"qod_type", value:"remote_analysis");
  script_tag(name:"solution_type", value:"VendorFix");

  exit(0);
}

# nb: Available since GOS 21.04.9 / openvas-scanner 21.4.4
if( ! defined_func( "socket_ssl_do_handshake" ) )
  exit( 0 );

include("ssl_funcs.inc");
include("list_array_func.inc");
include("misc_func.inc");
include("mysql.inc");

if( ! port = tls_ssl_get_port() )
  exit( 0 );

if( ! tls_get_supported_kb_versions( port:port ) )
  exit( 0 );

# nb: We're not using get_supported_tls_versions() from ssl_funcs.inc here on purpose because we
# want to only check the fixed / defined list of affected protocols below.
#
# nb: TLSv1.3 generally doesn't support renegotiation according to:
# https://wiki.openssl.org/index.php/TLS1.3#Renegotiation
transports[ENCAPS_SSLv3] = "SSLv3";
transports[ENCAPS_TLSv1] = "TLSv1.0";
transports[ENCAPS_TLSv11] = "TLSv1.1";
transports[ENCAPS_TLSv12] = "TLSv1.2";

# nb: Used later for doing the reporting
info = make_array();

# nb: Number of tries before the remote service is determined as vulnerable. We're currently trying
# it twice to avoid any false positives or similar.
num_tries = 2;

# nb: If SNI is supported we need to fork on each host name on our own. This is done because
# otherwise socket_negotiate_ssl() would fork internally and after we had called open_ssl_socket()
# which would cause issues with failed connections / socket communication. The fork on the available
# host names needs to be done before doing any socket operation (e.g. opening a socket).
if( get_kb_item( "sni/" + port + "/supported" ) )
  get_host_name();

foreach transport_num( keys( transports ) ) {

  transport_name = transports[transport_num];

  # If enabled the remote service isn't vulnerable.
  reneg_status = get_kb_item( "ssl_tls/safe_secure_renegotiation/" + port + "/" + tolower( transport_name ) + "/status" );
  if( reneg_status == "enabled" )
    continue;

  if( ! soc = open_ssl_socket( port:port ) )
    continue;

  # nb: socket_negotiate_ssl() is "upgrading" the socket and the socket number stays the same if
  # successful so we only need to check it like this. Furthermore if no SSL/TLS connection could be
  # estabilshed socket_negotiate_ssl() will close the passed socket internally so we don't need to
  # close it when doing the continue here.
  if( ! socket_negotiate_ssl( socket:soc, transport:transport_num ) )
    continue;

  count = 0;
  for( i = 0; i < num_tries; i++ ) {
    status = socket_ssl_do_handshake( socket:soc );
    # nb: From the function description:
    # 1 on success, less than 0 on handshake error. Null on nasl error.
    if( status == 1 )
      count++;
  }

  close( soc );

  if( count >= num_tries ) {
    VULN = TRUE;
    info[transport_name] = num_tries;
  }
}

if( VULN ) {
  report = text_format_table( array:info, sep:" | ", columnheader:make_list( "Protocol Version", "Successful re-done SSL/TLS handshakes (Renegotiation) over an existing / already established SSL/TLS connection" ) );
  security_message( port:port, data:report );
  exit( 0 );
}

exit( 99 );