LenelS2 NetBox hardcoded credentials authentication bypass

#!/usr/bin/env bash
# check-cve-2024-2420.sh
# Heuristic local version check for LenelS2 NetBox CVE-2024-2420.
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

TARGET_FIXED="5.6.2"
FOUND_VERSION=""

log() {
  echo "[INFO] $*" >&2
}

norm_ver() {
  # Convert dotted version to zero-padded comparable integer-ish string.
  # Example: 5.6.2 -> 0005 0006 0002
  local IFS='.'
  local parts=($1)
  printf "%04d%04d%04d%04d" "${parts[0]:-0}" "${parts[1]:-0}" "${parts[2]:-0}" "${parts[3]:-0}"
}

version_lt() {
  [[ "$(norm_ver "$1")" < "$(norm_ver "$2")" ]]
}

extract_version() {
  local candidate
  for candidate in \
    /etc/lenels2-release \
    /etc/netbox-release \
    /opt/lenels2/version \
    /opt/netbox/version \
    /usr/local/lenels2/version \
    /var/lib/lenels2/version \
    /var/www/html/version.txt; do
    if [[ -r "$candidate" ]]; then
      local v
      v=$(grep -Eo '[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z]+)?' "$candidate" 2>/dev/null | head -n1 || true)
      if [[ -n "$v" ]]; then
        echo "$v"
        return 0
      fi
    fi
  done

  # Try package managers
  if command -v dpkg-query >/dev/null 2>&1; then
    local v
    v=$(dpkg-query -W -f='${Package} ${Version}\n' 2>/dev/null | grep -Ei 'lenels2|netbox' | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1 || true)
    if [[ -n "$v" ]]; then
      echo "$v"
      return 0
    fi
  fi

  if command -v rpm >/dev/null 2>&1; then
    local v
    v=$(rpm -qa 2>/dev/null | grep -Ei 'lenels2|netbox' | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1 || true)
    if [[ -n "$v" ]]; then
      echo "$v"
      return 0
    fi
  fi

  # Try local web content/config trees for embedded version strings
  local search_roots=(/opt /usr/local /var/www /etc)
  for root in "${search_roots[@]}"; do
    if [[ -d "$root" ]]; then
      local v
      v=$(grep -RIEo 'NetBox[^0-9]{0,20}[0-9]+\.[0-9]+\.[0-9]+|[0-9]+\.[0-9]+\.[0-9]+' "$root" 2>/dev/null | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1 || true)
      if [[ -n "$v" ]]; then
        echo "$v"
        return 0
      fi
    fi
  done

  return 1
}

FOUND_VERSION=$(extract_version || true)

if [[ -z "$FOUND_VERSION" ]]; then
  echo "UNKNOWN - could not determine installed NetBox version from common local artifacts"
  exit 2
fi

log "Detected NetBox version: $FOUND_VERSION"

# Strip any suffix after the numeric semver core
FOUND_VERSION=$(echo "$FOUND_VERSION" | grep -Eo '^[0-9]+\.[0-9]+\.[0-9]+' || true)

if [[ -z "$FOUND_VERSION" ]]; then
  echo "UNKNOWN - version string found but could not normalize it"
  exit 2
fi

if version_lt "$FOUND_VERSION" "$TARGET_FIXED"; then
  echo "VULNERABLE - detected version $FOUND_VERSION is earlier than fixed version $TARGET_FIXED"
  exit 1
fi

if [[ "$FOUND_VERSION" == "$TARGET_FIXED" ]] || ! version_lt "$FOUND_VERSION" "$TARGET_FIXED"; then
  echo "PATCHED - detected version $FOUND_VERSION is at or above fixed version $TARGET_FIXED"
  exit 0
fi

echo "UNKNOWN - unable to compare version reliably"
exit 2