Erlang/OTP (Erlang OTP) Path Traversal Vulnerability (Jun 2025)

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:erlang:erlang%2fotp";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.119038");
  script_version("2025-06-18T05:40:25+0000");
  script_tag(name:"last_modification", value:"2025-06-18 05:40:25 +0000 (Wed, 18 Jun 2025)");
  script_tag(name:"creation_date", value:"2025-06-16 14:25:23 +0000 (Mon, 16 Jun 2025)");
  script_tag(name:"cvss_base", value:"3.6");
  script_tag(name:"cvss_base_vector", value:"AV:L/AC:L/Au:N/C:N/I:P/A:P");
  script_cve_id("CVE-2025-4748");
  script_name("Erlang/OTP (Erlang OTP) Path Traversal Vulnerability (Jun 2025)");
  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("General");
  script_dependencies("gb_erlang_otp_ssh_banner_detect.nasl");
  script_mandatory_keys("erlang/otp/detected");

  script_xref(name:"URL", value:"https://github.com/erlang/otp/security/advisories/GHSA-9g37-pgj9-wrhc");
  script_xref(name:"URL", value:"https://github.com/erlang/otp/pull/9941");
  script_xref(name:"URL", value:"https://www.openwall.com/lists/oss-security/2025/06/16/5");

  script_tag(name:"summary", value:"Erlang/OTP (Erlang OTP) is prone to a restricted directory
  ('Path Traversal') vulnerability in the stdlib/zip modules.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"When the zip module is used to extract files to disk and the
  archive is maliciously corrupted by including absolute file paths, the zip module would extract
  them as absolute paths instead of stripping the leading /, drive or device letter.

  This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines
  zip:unzip/1, zip:unzip/2, zip:extract/1, zip:extract/2 unless the memory option is passed.");

  script_tag(name:"affected", value:"Erlang/OTP (Erlang OTP) versions prior to 26.2.5.13, 27.x prior
  to 27.3.4.1 and 28.0.0 only.

  Note: While the advisory states affected versions are starting from 17.0 later the vendor states:

  > In the case of this vulnerability, versions prior to OTP 17.0 are likely also affected.");

  script_tag(name:"solution", value:"Update to version 26.2.5.13, 27.3.4.1, 28.0.1 or later.");

  # nb: Only a single low QoD VT as the problem happens in the zip module which might not be enabled
  # on the remote SSH server at all.
  script_tag(name:"qod_type", value:"remote_banner_unreliable");
  script_tag(name:"solution_type", value:"VendorFix");

  exit(0);
}

include("version_func.inc");
include("host_details.inc");

if( isnull( port = get_app_port( cpe:CPE ) ) )
  exit( 0 );

if( ! infos = get_app_version_and_location( cpe:CPE, port:port, exit_no_version:TRUE ) )
  exit( 0 );

version = infos["version"];
location = infos["location"];

if( version_is_less( version:version, test_version:"26.2.5.13" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"26.2.5.13", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

if( version_in_range_exclusive( version:version, test_version_lo:"27.0", test_version_up:"27.3.4.1" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"27.3.4.1", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

if( version_is_equal( version:version, test_version:"28.0" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"28.0.1", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

exit( 99 );