Apache Tomcat Authentication Bypass Vulnerability (Nov 2024) - Windows

# SPDX-FileCopyrightText: 2024 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:apache:tomcat";

if (description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.153463");
  script_version("2024-12-19T05:05:34+0000");
  script_tag(name:"last_modification", value:"2024-12-19 05:05:34 +0000 (Thu, 19 Dec 2024)");
  script_tag(name:"creation_date", value:"2024-11-18 13:55:36 +0000 (Mon, 18 Nov 2024)");
  script_tag(name:"cvss_base", value:"6.4");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:P/A:N");

  script_cve_id("CVE-2024-52316");

  script_tag(name:"qod_type", value:"remote_banner");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Apache Tomcat Authentication Bypass Vulnerability (Nov 2024) - Windows");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2024 Greenbone AG");
  script_family("Web Servers");
  script_dependencies("gb_apache_tomcat_consolidation.nasl", "os_detection.nasl");
  script_mandatory_keys("apache/tomcat/detected", "Host/runs_windows");

  script_tag(name:"summary", value:"Apache Tomcat is prone to an authentication bypass
  vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"If Tomcat was configured to use a custom Jakarta Authentication
  (formerly JASPIC) ServerAuthContext component which may throw an exception during the
  authentication process without explicitly setting an HTTP status to indicate failure, the
  authentication may not have failed, allowing the user to bypass the authentication process. There
  are no known Jakarta Authentication components that behave in this way.");

  script_tag(name:"affected", value:"Apache Tomcat versions prior to 9.0.96, 10.0.x through 10.1.30
  and 11.0.0-M1 through 11.0.0-M26.

  Note: While not explicitly mentioned by the vendor (due to the EOL status of these branches) it is
  assumed that the whole 10.x branch and all versions prior to 9.x are affected by this flaw. If you
  disagree with this assessment and want to accept the risk please create an override for this
  result.");

  script_tag(name:"solution", value:"Update to version 9.0.96, 10.1.31, 11.0.0 or later.");

  script_xref(name:"URL", value:"https://lists.apache.org/thread/lopzlqh91jj9n334g02om08sbysdb928");
  script_xref(name:"URL", value:"https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0");
  script_xref(name:"URL", value:"https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.31");
  script_xref(name:"URL", value:"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.96");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_is_less(version: version, test_version: "9.0.96")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "9.0.96", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "10.0.0", test_version_up: "10.1.31")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "10.1.31", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range(version: version, test_version: "11.0.0.M1", test_version2: "11.0.0.M21")) {
  report = report_fixed_ver(installed_version: version, fixed_version: "11.0.0", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);