Nginx 1.11.4 - 1.27.3 TLS Session Resumption Vulnerability

# SPDX-FileCopyrightText: 2025 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only

CPE = "cpe:/a:nginx:nginx";

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.153971");
  script_version("2025-11-04T05:40:22+0000");
  script_tag(name:"last_modification", value:"2025-11-04 05:40:22 +0000 (Tue, 04 Nov 2025)");
  script_tag(name:"creation_date", value:"2025-02-06 09:48:08 +0000 (Thu, 06 Feb 2025)");
  script_tag(name:"cvss_base", value:"4.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:S/C:P/I:N/A:N");
  script_tag(name:"severity_vector", value:"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N");
  script_tag(name:"severity_origin", value:"NVD");
  script_tag(name:"severity_date", value:"2025-02-05 18:15:33 +0000 (Wed, 05 Feb 2025)");

  script_cve_id("CVE-2025-23419");

  script_tag(name:"qod_type", value:"remote_banner_unreliable");

  script_tag(name:"solution_type", value:"VendorFix");

  script_name("Nginx 1.11.4 - 1.27.3 TLS Session Resumption Vulnerability");

  script_category(ACT_GATHER_INFO);

  script_copyright("Copyright (C) 2025 Greenbone AG");
  script_family("Web Servers");
  script_dependencies("gb_nginx_consolidation.nasl");
  script_mandatory_keys("nginx/detected");

  script_tag(name:"summary", value:"Nginx is prone to a TLS session resumption vulnerability.");

  script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");

  script_tag(name:"insight", value:"When name-based virtual hosts are configured to share the same
  IP address and port combination, with TLS 1.3 and OpenSSL, a previously authenticated attacker
  can use session resumption to bypass client certificate authentication requirements on these
  servers. This vulnerability arises when TLS session tickets are used and/or the SSL session cache
  is used in the default virtual server and the default virtual server is performing client
  certificate authentication. This issue affects both the NGINX http and NGINX stream modules.");

  script_tag(name:"impact", value:"This vulnerability can lead to the exposure of resources or
  functionality to unintended actors, possibly providing attackers with limited access to sensitive
  information.");

  script_tag(name:"affected", value:"Nginx versions 1.11.4 through 1.27.3.");

  script_tag(name:"solution", value:"Update to version 1.26.3, 1.27.4 or later.");

  script_xref(name:"URL", value:"https://nginx.org/en/security_advisories.html");
  script_xref(name:"URL", value:"https://mailman.nginx.org/pipermail/nginx-announce/2025/NYEUJX7NCBCGJGXDFVXNMAAMJDFSE45G.html");
  script_xref(name:"URL", value:"https://my.f5.com/manage/s/article/K000149173");

  exit(0);
}

include("host_details.inc");
include("version_func.inc");

if (isnull(port = get_app_port(cpe: CPE)))
  exit(0);

if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
  exit(0);

version = infos["version"];
location = infos["location"];

if (version_in_range_exclusive(version: version, test_version_lo: "1.11.4", test_version_up: "1.26.3")) {
  report = report_fixed_ver( installed_version: version, fixed_version: "1.26.3", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

if (version_in_range_exclusive(version: version, test_version_lo: "1.27.0", test_version_up: "1.27.4")) {
  report = report_fixed_ver( installed_version: version, fixed_version: "1.27.4", install_path: location);
  security_message(port: port, data: report);
  exit(0);
}

exit(99);