Curl 7.85.0 < 8.7.0 Input Misinterpretation (CVE-2024-2004)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(192699);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/07/04");

  script_cve_id("CVE-2024-2004");
  script_xref(name:"IAVA", value:"2024-A-0185");

  script_name(english:"Curl 7.85.0 < 8.7.0 Input Misinterpretation (CVE-2024-2004)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host has a program that is affected by an input misinterpretation vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Curl installed on the remote host is between 7.85.0 and prior to 8.7.0. It is, therefore, affected by an
input misinterpretation vulnerability. When a protocol selection parameter option disables all protocols without adding
any then the default set of protocols would remain in the allowed set due to an error in the logic for removing
protocols. The flaw is only present if the set of selected protocols disables the entire set of available protocols, in
itself a command with no practical use and therefore unlikely to be encountered in real situations.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://curl.se/docs/CVE-2024-2004.html");
  script_set_attribute(attribute:"solution", value:
"Upgrade Curl to version 8.7.0 or later");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-2004");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/03/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/03/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/03/29");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:haxx:curl");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("curl_win_installed.nbin", "curl_nix_installed.nbin");
  script_require_keys("installed_sw/Curl");

  exit(0);
}

include('vcf.inc');

var win_local;
if (!empty_or_null(get_kb_item('SMB/Registry/Enumerated')))
  win_local = TRUE;
else
  win_local = FALSE;

var app_info = vcf::get_app_info(app:'Curl', win_local:win_local);

vcf::check_all_backporting(app_info:app_info);

var constraints = [ 
  {'min_version': '7.85.0', 'fixed_version': '8.7.0'} 
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);