Nextcloud Server Multiple Vulnerabilities (GHSA-24wp-p865-7j4r)

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:nextcloud:nextcloud_server";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.125571");
  script_version("2025-12-10T05:45:47+0000");
  script_tag(name:"last_modification", value:"2025-12-10 05:45:47 +0000 (Wed, 10 Dec 2025)");
  script_tag(name:"creation_date", value:"2025-12-09 08:08:40 +0000 (Tue, 09 Dec 2025)");
  script_tag(name:"cvss_base", value:"10.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2025-01-22 17:16:51 +0000 (Wed, 22 Jan 2025)");

  script_cve_id("CVE-2025-59788", "CVE-2024-4367");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Nextcloud Server Multiple Vulnerabilities (GHSA-24wp-p865-7j4r)");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("gb_nextcloud_server_http_detect.nasl");
  script_mandatory_keys("nextcloud/server/detected");

  script_tag(name:"summary", value:"Nextcloud Server is prone to multiple vulnerabilities.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"The following vulnerabilities exist:

  - CVE-2025-59788: Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer
  example directory allows attackers to execute arbitrary JavaScript in the context of a
  user's browser via a crafted PDF file to viewer.html.

  - CVE-2024-4367: A type check was missing when handling fonts in PDF.js, which would allow
  arbitrary JavaScript execution in the PDF.js context.");

  script_tag(name:"affected", value:"Nextcloud Server prior to version 22.2.10.33, 23.x prior
  to 23.0.12.29, 24.x prior to 24.0.12.28, 25.x prior to 25.0.13.23, 26.x prior to
  26.0.13.20, 27.x prior to 27.1.11.20, 28.x prior to 28.0.14.11, 29.x prior to 29.0.16.8,
  30.x prior to 30.0.17, 31.x prior to 31.0.10 and 32.x prior to 32.0.1.");

  script_tag(name:"solution", value:"Update to version 22.2.10.33, 23.0.12.29, 24.0.12.28,
  25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, 32.0.1 or
  later.");

  script_xref(name:"URL", value:"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-24wp-p865-7j4r");
  script_xref(name:"URL", value:"https://www.redteam-pentesting.de/en/advisories/rt-sa-2025-003/");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (!port = get_app_port(cpe: CPE))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_is_less(version: version, test_version: "22.2.10.33")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "22.2.10.33", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "23.0.0", test_version_up: "23.0.12.29")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "23.0.12.29", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "24.0.0", test_version_up: "24.0.12.28")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "24.0.12.28", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "25.0.0", test_version_up: "25.0.13.23")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "25.0.13.23", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "26.0.0", test_version_up: "26.0.13.20")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "26.0.13.20", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "27.0.0", test_version_up: "27.1.11.20")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "27.1.11.20", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "28.0.0", test_version_up: "28.0.14.11")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "28.0.14.11", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "29.0.0", test_version_up: "29.0.16.8")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "29.0.16.8", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "30.0.0", test_version_up: "30.0.17")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "30.0.17", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "31.0.0", test_version_up: "31.0.10")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "31.0.10", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "32.0.0", test_version_up: "32.0.1")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "32.0.1", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);