NSE scripts setting CPE via nmap.set_port_version can conflict/overwrite each other.
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 13.6k
- Forks
- 2.9k
- PR merge metrics
- No merged PRs in 30d
Description
If 2 scripts are running at the same time and both call nmap.set_port_version, the one that calls it last "wins". In most cases, this isn't a problem, since there will be only one product/service/version. But in the case of CPE strings, it has a deleterious effect, since each script is working on its own copy of the port object:
- Service scan: here are the CPEs for this port:
["cpe1"] - Script A: I have another one. Now the CPEs are
["cpe1", "cpe2"] - Script B: I have another one. Now the CPEs are
["cpe1", "cpe3"]
In this example, "cpe2" is lost. This could be resolved by:
- working on the same port object instead of copies, with the associated synchronization difficulties.
- Checking the currently set list of CPEs on the "real" ServiceDeductions object before setting new ones.
- Some other creative scheme.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the nmap.set_port_version entry point and the ServiceDeductions handling described in the issue. Compare how concurrent NSE scripts update CPE lists, then choose and document a synchronization or merge approach. Done means CPEs reported by both scripts are retained rather than one overwriting the other.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- lua
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100