Foreman 1.9 < 1.16.1 Multiple Vulnerabilities

# SPDX-FileCopyrightText: 2018 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:theforeman:foreman";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.140939");
  script_version("2025-03-20T05:38:32+0000");
  script_tag(name:"last_modification", value:"2025-03-20 05:38:32 +0000 (Thu, 20 Mar 2025)");
  script_tag(name:"creation_date", value:"2018-04-03 16:45:09 +0700 (Tue, 03 Apr 2018)");
  script_tag(name:"cvss_base", value:"4.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:S/C:P/I:N/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2019-10-09 23:38:00 +0000 (Wed, 09 Oct 2019)");

  script_cve_id("CVE-2018-1097");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Foreman 1.9 < 1.16.1 Multiple Vulnerabilities");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2018 Greenbone AG");
  script_family("Web application abuses");
  script_dependencies("gb_foreman_http_detect.nasl");
  script_mandatory_keys("foreman/detected");

  script_tag(name:"summary", value:"Foreman is prone to multiple vulnerabilities.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"The following flaws exist:

  - One of the parameters passed when saving widget positions on the dashboard is not properly
  escaped leading to possibility of SQL injection. Due to the nature of the query, exploitation is
  limited to possible information disclosure and does not allow modifications to the database. The
  vulnerable endpoint is only available to authenticated users.

  - CVE-2018-1097: Users with limited permissions for powering oVirt/RHV hosts on and off may
  discover the username and password used to connect to the compute resource.");

  script_tag(name:"affected", value:"Foreman version 1.9 through 1.16.0.");

  script_tag(name:"solution", value:"Update to version 1.16.1 or later.");

  script_xref(name:"URL", value:"https://projects.theforeman.org/issues/23028");
  script_xref(name:"URL", value:"https://projects.theforeman.org/issues/22546");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (!port = get_app_port(cpe: CPE))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_in_range(version: version, test_version: "1.9", test_version2: "1.16.0")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "1.16.1", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);