Johnson Controls Metasys Improper Restriction of XML External Entity Reference (CVE-2020-9044)

#%NASL_MIN_LEVEL 70300
##
# (C) Tenable Network Security, Inc.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(500435);
  script_version("1.7");
  script_set_attribute(attribute:"plugin_modification_date", value:"2024/03/04");

  script_cve_id("CVE-2020-9044");
  script_xref(name:"CERT", value:"ICS-CERT Advisory");

  script_name(english:"Johnson Controls Metasys Improper Restriction of XML External Entity Reference (CVE-2020-9044)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks
or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite)
versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data
Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation
Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59)
versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control
Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke
Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1.  

This plugin
only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://www.johnsoncontrols.com/cyber-solutions/security-advisories");
  script_set_attribute(attribute:"see_also", value:"https://www.us-cert.gov/ics/advisories/icsa-20-070-05");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Users should contact a branch office for remediation. For more detailed mitigation instructions, please see Johnson
Controls Product Security Advisory JCI-PSA-2020-3 v1

For questions concerning this product, contact Johnson Controls Global Product Security; email: [email protected]");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2020-9044");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(611);

  script_set_attribute(attribute:"vuln_publication_date", value:"2020/03/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/03/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2022/02/07");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nae55_firmware:9.0.1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nae55_firmware:9.0.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nae55_firmware:9.0.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nae55_firmware:9.0.5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nae55_firmware:9.0.6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nie55_firmware:9.0.1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nie55_firmware:9.0.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nie55_firmware:9.0.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nie55_firmware:9.0.5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nie55_firmware:9.0.6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nie59_firmware:9.0.1");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nie59_firmware:9.0.2");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nie59_firmware:9.0.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nie59_firmware:9.0.5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nie59_firmware:9.0.6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nae85_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nie85_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:johnsoncontrols:nae55_firmware:8.1");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2022-2024 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/JohnsonControls");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/JohnsonControls');

var asset = tenable_ot::assets::get(vendor:'JohnsonControls');

var vuln_cpes = {
    "cpe:/o:johnsoncontrols:nae55_firmware:9.0.1" :
        {"versionEndIncluding" : "9.0.1", "versionStartIncluding" : "9.0.1", "family" : "MetasysNae"},
    "cpe:/o:johnsoncontrols:nae55_firmware:9.0.2" :
        {"versionEndIncluding" : "9.0.2", "versionStartIncluding" : "9.0.2", "family" : "MetasysNae"},
    "cpe:/o:johnsoncontrols:nae55_firmware:9.0.3" :
        {"versionEndIncluding" : "9.0.3", "versionStartIncluding" : "9.0.3", "family" : "MetasysNae"},
    "cpe:/o:johnsoncontrols:nae55_firmware:9.0.5" :
        {"versionEndIncluding" : "9.0.5", "versionStartIncluding" : "9.0.5", "family" : "MetasysNae"},
    "cpe:/o:johnsoncontrols:nae55_firmware:9.0.6" :
        {"versionEndIncluding" : "9.0.6", "versionStartIncluding" : "9.0.6", "family" : "MetasysNae"},
    "cpe:/o:johnsoncontrols:nie55_firmware:9.0.1" :
        {"versionEndIncluding" : "9.0.1", "versionStartIncluding" : "9.0.1", "family" : "MetasysNie"},
    "cpe:/o:johnsoncontrols:nie55_firmware:9.0.2" :
        {"versionEndIncluding" : "9.0.2", "versionStartIncluding" : "9.0.2", "family" : "MetasysNie"},
    "cpe:/o:johnsoncontrols:nie55_firmware:9.0.3" :
        {"versionEndIncluding" : "9.0.3", "versionStartIncluding" : "9.0.3", "family" : "MetasysNie"},
    "cpe:/o:johnsoncontrols:nie55_firmware:9.0.5" :
        {"versionEndIncluding" : "9.0.5", "versionStartIncluding" : "9.0.5", "family" : "MetasysNie"},
    "cpe:/o:johnsoncontrols:nie55_firmware:9.0.6" :
        {"versionEndIncluding" : "9.0.6", "versionStartIncluding" : "9.0.6", "family" : "MetasysNie"},
    "cpe:/o:johnsoncontrols:nie59_firmware:9.0.1" :
        {"versionEndIncluding" : "9.0.1", "versionStartIncluding" : "9.0.1", "family" : "MetasysNie"},
    "cpe:/o:johnsoncontrols:nie59_firmware:9.0.2" :
        {"versionEndIncluding" : "9.0.2", "versionStartIncluding" : "9.0.2", "family" : "MetasysNie"},
    "cpe:/o:johnsoncontrols:nie59_firmware:9.0.3" :
        {"versionEndIncluding" : "9.0.3", "versionStartIncluding" : "9.0.3", "family" : "MetasysNie"},
    "cpe:/o:johnsoncontrols:nie59_firmware:9.0.5" :
        {"versionEndIncluding" : "9.0.5", "versionStartIncluding" : "9.0.5", "family" : "MetasysNie"},
    "cpe:/o:johnsoncontrols:nie59_firmware:9.0.6" :
        {"versionEndIncluding" : "9.0.6", "versionStartIncluding" : "9.0.6", "family" : "MetasysNie"},
    "cpe:/o:johnsoncontrols:nae85_firmware" :
        {"versionEndIncluding" : "10.1", "family" : "MetasysNae"},
    "cpe:/o:johnsoncontrols:nie85_firmware" :
        {"versionEndIncluding" : "10.1", "family" : "MetasysNie"},
    "cpe:/o:johnsoncontrols:nae55_firmware:8.1" :
        {"versionEndIncluding" : "8.1", "versionStartIncluding" : "8.1", "family" : "MetasysNae"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);