Erlang/OTP (Erlang OTP) TLS Client Authentication Bypass Vulnerability (GHSA-f7jg-qm7f-ppm8) - Windows

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:erlang:erlang%2fotp";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.119109");
  script_version("2025-09-16T05:38:45+0000");
  script_tag(name:"last_modification", value:"2025-09-16 05:38:45 +0000 (Tue, 16 Sep 2025)");
  script_tag(name:"creation_date", value:"2025-09-15 13:03:57 +0000 (Mon, 15 Sep 2025)");
  script_tag(name:"cvss_base", value:"10.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2022-09-23 18:05:13 +0000 (Fri, 23 Sep 2022)");
  script_cve_id("CVE-2022-37026");
  script_name("Erlang/OTP (Erlang OTP) TLS Client Authentication Bypass Vulnerability (GHSA-f7jg-qm7f-ppm8) - Windows");
  script_category(ACT_GATHER_INFO);
  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("General");
  script_dependencies("gb_erlang_otp_ssh_banner_detect.nasl", "os_detection.nasl");
  script_mandatory_keys("erlang/otp/detected", "Host/runs_windows");

  script_xref(name:"URL", value:"https://github.com/erlang/otp/security/advisories/GHSA-f7jg-qm7f-ppm8");

  script_tag(name:"summary", value:"Erlang/OTP (Erlang OTP) is prone to a TLS client authentication
  bypass vulnerability in the ssl component.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"A logical error in the TLS (SSL) implementation allows client
  certificates to be accepted without checking that the client certificate actually belongs to the
  client. This should be checked by verifying the signature sent by the client in certificate verify
  message, but due to the error this step could be skipped.

  Impacted are those who are running an SSL/TLS/DTLS server using the ssl application either
  directly or indirectly via other applications. For example via inets (httpd), cowboy, etc.

  Note that the vulnerability only affects servers that request client certification, that is sets
  the option {verify, verify_peer}.");

  script_tag(name:"affected", value:"Erlang/OTP (Erlang OTP) versions prior to 23.3.4.15, 24.x prior
  to 24.3.4.2 and 25.x prior to 25.1.

  Note: While the advisory initially states that versions >= 17.0 are affected it also include
  the following note:

  > In the case of this vulnerability, versions prior to OTP 17.0 are likely also affected.");

  script_tag(name:"solution", value:"Update to version 23.3.4.15, 24.3.4.2, 25.1 or later.");

  script_tag(name:"qod_type", value:"remote_banner");
  script_tag(name:"solution_type", value:"VendorFix");

  exit(0);
}

include("version_func.inc");
include("host_details.inc");

if( isnull( port = get_app_port( cpe:CPE ) ) )
  exit( 0 );

if( ! infos = get_app_version_and_location( cpe:CPE, port:port, exit_no_version:TRUE ) )
  exit( 0 );

version = infos["version"];
location = infos["location"];

if( version_is_less( version:version, test_version:"23.3.4.15" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"23.3.4.15", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

if( version_in_range_exclusive( version:version, test_version_lo:"24.0", test_version_up:"24.3.4.2" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"24.3.4.2", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

if( version_in_range_exclusive( version:version, test_version_lo:"25.0", test_version_up:"25.1" ) ) {
  report = report_fixed_ver( installed_version:version, fixed_version:"25.1", install_path:location );
  security_message( port:port, data:report );
  exit( 0 );
}

exit( 99 );