SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN

#!/usr/bin/env python3
# verify_cve_2024_12802.py
# Inventory-based verifier for SonicWall CVE-2024-12802
# Output per row: VULNERABLE / PATCHED / UNKNOWN
# Exit codes:
#   0 = all assessed rows PATCHED
#   1 = one or more rows VULNERABLE
#   2 = no VULNERABLE rows, but one or more UNKNOWN rows
#   3 = usage / file / parsing error

import csv
import re
import sys
from typing import Tuple

REQUIRED = [
    'hostname',
    'platform',
    'version',
    'sslvpn_enabled',
    'auth_backend',
    'extra_upn_suffix',
    'gen6_manual_remediation_complete'
]

FIXED = {
    'gen6_nsv_6.5.4.4': '6.5.4.4-44v-21-2472',
    'gen6_hw': '6.5.5.1-6n',
    'gen7_nsv': '7.0.1-5165',
    'gen7_hw': '7.1.3-7015',
    'tz80': '8.0.0-8037',
}


def norm_bool(v: str):
    if v is None:
        return None
    s = str(v).strip().lower()
    if s in ('1', 'true', 'yes', 'y', 'enabled'):
        return True
    if s in ('0', 'false', 'no', 'n', 'disabled'):
        return False
    return None


def version_key(v: str) -> Tuple[int, ...]:
    nums = re.findall(r'\d+', v or '')
    return tuple(int(x) for x in nums)


def ge(v1: str, v2: str) -> bool:
    return version_key(v1) >= version_key(v2)


def classify_branch(platform: str, version: str):
    p = (platform or '').strip().lower()
    v = (version or '').strip().lower()

    if 'tz80' in p:
        return 'tz80'
    if 'gen7' in p and 'nsv' in p:
        return 'gen7_nsv'
    if 'gen7' in p:
        return 'gen7_hw'
    if 'gen6' in p and 'nsv' in p:
        if v.startswith('6.5.4.4-44v-21-'):
            return 'gen6_nsv_6.5.4.4'
        return 'gen6_nsv_6.5.4.4'
    if 'gen6' in p:
        return 'gen6_hw'

    # Fallback from version only
    if v.startswith('8.0.0-'):
        return 'tz80'
    if v.startswith('7.0.1-'):
        return 'gen7_nsv'
    if v.startswith('7.1.'):
        return 'gen7_hw'
    if v.startswith('6.5.4.4-44v-21-'):
        return 'gen6_nsv_6.5.4.4'
    if v.startswith('6.5.'):
        return 'gen6_hw'
    return None


def assess(row):
    host = row['hostname']
    version = (row['version'] or '').strip()
    platform = (row['platform'] or '').strip()
    sslvpn = norm_bool(row['sslvpn_enabled'])
    auth_backend = (row['auth_backend'] or '').strip().lower()
    extra_upn = norm_bool(row['extra_upn_suffix'])
    gen6_steps = norm_bool(row['gen6_manual_remediation_complete'])

    if not version or not platform:
        return host, 'UNKNOWN', 'missing platform/version'

    branch = classify_branch(platform, version)
    if branch is None:
        return host, 'UNKNOWN', 'unrecognized SonicOS branch'

    # Reachability / applicability gates
    if sslvpn is False:
        return host, 'PATCHED', 'SSLVPN disabled; issue not reachable'
    if sslvpn is None:
        return host, 'UNKNOWN', 'unknown whether SSLVPN is enabled'

    if auth_backend not in ('ad', 'ldap', 'active_directory', 'microsoft_ad', 'microsoft ldap'):
        return host, 'PATCHED', 'not using AD/LDAP-backed SSLVPN auth'

    if extra_upn is False:
        return host, 'PATCHED', 'no extra AD UPN suffix indicated'
    if extra_upn is None:
        return host, 'UNKNOWN', 'unknown whether extra AD UPN suffix / alternate UPN path exists'

    fixed = FIXED[branch]
    at_or_above_fixed = ge(version, fixed)

    # Branch-specific handling
    if branch in ('gen6_hw', 'gen6_nsv_6.5.4.4'):
        if not at_or_above_fixed:
            return host, 'VULNERABLE', f'firmware below fixed level {fixed}'
        if gen6_steps is True:
            return host, 'PATCHED', 'firmware fixed and Gen6 manual remediation confirmed'
        if gen6_steps is False:
            return host, 'VULNERABLE', 'firmware fixed but Gen6 manual remediation incomplete'
        return host, 'UNKNOWN', 'firmware fixed but Gen6 manual remediation status unknown'

    # Gen7 / TZ80: firmware is the dominant remediation signal per published reporting
    if not at_or_above_fixed:
        return host, 'VULNERABLE', f'firmware below fixed level {fixed}'
    return host, 'PATCHED', 'firmware at or above fixed level'


def main():
    if len(sys.argv) != 2:
        print('Usage: python3 verify_cve_2024_12802.py inventory.csv', file=sys.stderr)
        sys.exit(3)

    path = sys.argv[1]
    vulnerable = 0
    unknown = 0

    try:
        with open(path, newline='', encoding='utf-8-sig') as f:
            reader = csv.DictReader(f)
            missing = [c for c in REQUIRED if c not in (reader.fieldnames or [])]
            if missing:
                print('Missing required columns: ' + ', '.join(missing), file=sys.stderr)
                sys.exit(3)

            for row in reader:
                host, state, reason = assess(row)
                print(f'{host},{state},{reason}')
                if state == 'VULNERABLE':
                    vulnerable += 1
                elif state == 'UNKNOWN':
                    unknown += 1

    except FileNotFoundError:
        print(f'File not found: {path}', file=sys.stderr)
        sys.exit(3)
    except Exception as e:
        print(f'Error: {e}', file=sys.stderr)
        sys.exit(3)

    if vulnerable:
        sys.exit(1)
    if unknown:
        sys.exit(2)
    sys.exit(0)


if __name__ == '__main__':
    main()