Django 4.x < 4.2.22, 5.0.x < 5.1.10, 5.2.x < 5.2.2 Log Injection Vulnerability - Windows

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:djangoproject:django";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.127896");
  script_version("2025-10-16T07:37:11+0000");
  script_tag(name:"last_modification", value:"2025-10-16 07:37:11 +0000 (Thu, 16 Oct 2025)");
  script_tag(name:"creation_date", value:"2025-06-05 07:50:10 +0000 (Thu, 05 Jun 2025)");
  script_tag(name:"cvss_base", value:"5.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:P/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2025-10-15 17:47:56 +0000 (Wed, 15 Oct 2025)");

  script_cve_id("CVE-2025-48432");

  script_tag(name:"qod_type", value:"executable_version");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Django 4.x < 4.2.22, 5.0.x < 5.1.10, 5.2.x < 5.2.2 Log Injection Vulnerability - Windows");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("gb_django_detect_win.nasl");
  script_mandatory_keys("django/windows/detected");

  script_tag(name:"summary", value:"Django is prone to a log injection vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"Internal HTTP response logging used request.path directly,
  allowing control characters (e.g. newlines or ANSI escape sequences) to be written unescaped
  into logs. This could enable log injection or forgery, letting attackers manipulate log
  appearance or structure, especially in logs processed by external systems or viewed in
  terminals.");

  script_tag(name:"affected", value:"Django version 4.x prior to 4.2.22, 5.0.x, 5.1.x prior to
  5.1.10 and 5.2.x prior to 5.2.2.");

  script_tag(name:"solution", value:"Update to version 4.2.22, 5.1.10, 5.2.2 or later.");

  script_xref(name:"URL", value:"https://www.djangoproject.com/weblog/2025/jun/04/security-releases/");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (!infos = get_app_version_and_location(cpe: CPE, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_in_range_exclusive(version: version, test_version_lo: "4.0", test_version_up: "4.2.22")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "4.2.22", install_path: location);
  security_message(port: 0, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "5.0", test_version_up: "5.1.10")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "5.1.10", install_path: location);
  security_message(port: 0, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "5.2", test_version_up: "5.2.2")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "5.2.2", install_path: location);
  security_message(port: 0, data: report);
  exit(0);
}

exit(99);