A buffer overflow vulnerability in the User-ID™ Authentication Portal

#!/usr/bin/env python3
# CVE-2026-0300 exposure checker for PAN-OS
# Checks PAN-OS version and attempts to infer whether User-ID Authentication Portal
# / Captive Portal exposure is configured from exported configuration.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/runtime error

import argparse
import re
import sys
import ssl
import urllib.parse
import urllib.request
import xml.etree.ElementTree as ET
from distutils.version import LooseVersion

FIXED = {
    '12.1': ['12.1.4-h5', '12.1.7'],
    '11.2': ['11.2.4-h17', '11.2.7-h13', '11.2.10-h6', '11.2.12'],
    '11.1': ['11.1.4-h33', '11.1.6-h32', '11.1.7-h6', '11.1.10-h25', '11.1.13-h5', '11.1.15'],
    '10.2': ['10.2.7-h34', '10.2.10-h36', '10.2.13-h21', '10.2.16-h7', '10.2.18-h6'],
}

AFFECTED_BRANCHES = ('12.1', '11.2', '11.1', '10.2')


def parse_args():
    ap = argparse.ArgumentParser(description='Assess PAN-OS exposure to CVE-2026-0300')
    ap.add_argument('--host', required=True, help='PAN-OS management IP or hostname')
    ap.add_argument('--api-key', required=True, help='PAN-OS XML API key')
    ap.add_argument('--port', default='443', help='Management HTTPS port (default: 443)')
    ap.add_argument('--insecure', action='store_true', help='Disable TLS certificate verification')
    return ap.parse_args()


def http_get(url, insecure=False):
    ctx = None
    if insecure:
        ctx = ssl.create_default_context()
        ctx.check_hostname = False
        ctx.verify_mode = ssl.CERT_NONE
    req = urllib.request.Request(url, headers={'User-Agent': 'noisgate-cve-2026-0300-check/1.0'})
    with urllib.request.urlopen(req, context=ctx, timeout=20) as resp:
        return resp.read()


def api_url(host, port, params):
    q = urllib.parse.urlencode(params)
    return f'https://{host}:{port}/api/?{q}'


def fetch_system_info(host, port, key, insecure=False):
    cmd = '<show><system><info/></system></show>'
    url = api_url(host, port, {'type': 'op', 'cmd': cmd, 'key': key})
    raw = http_get(url, insecure=insecure)
    root = ET.fromstring(raw)
    if root.attrib.get('status') != 'success':
        raise RuntimeError('API call for system info failed')
    sw = root.find('.//sw-version')
    hn = root.find('.//hostname')
    return (sw.text.strip() if sw is not None and sw.text else None,
            hn.text.strip() if hn is not None and hn.text else host)


def fetch_running_config(host, port, key, insecure=False):
    url = api_url(host, port, {'type': 'export', 'category': 'configuration', 'key': key})
    return http_get(url, insecure=insecure).decode('utf-8', errors='ignore')


def branch_of(version):
    m = re.match(r'^(\d+\.\d+)', version)
    return m.group(1) if m else None


def normalize(v):
    return v.lower().strip()


def version_ge(a, b):
    # LooseVersion handles PAN-OS hotfix strings well enough for audit use.
    return LooseVersion(normalize(a)) >= LooseVersion(normalize(b))


def is_version_patched(version):
    branch = branch_of(version)
    if branch not in FIXED:
        return None
    return any(version_ge(version, fixed) for fixed in FIXED[branch])


def is_version_in_scope(version):
    branch = branch_of(version)
    return branch in AFFECTED_BRANCHES


def infer_portal_exposure(config_text):
    t = config_text.lower()

    # Heuristic indicators only; PAN-OS config structures vary by release.
    portal_enabled = False
    if 'authentication-portal' in t or 'captive-portal' in t:
        # Try to avoid false positives from docs/comments by requiring nearby enable-like markers.
        portal_enabled = bool(re.search(r'(authentication-portal|captive-portal).{0,250}(yes|true|enable|enabled)', t, re.S))
        if not portal_enabled:
            # Still keep a softer signal if portal section exists at all.
            portal_enabled = 'authentication-portal' in t or 'captive-portal' in t

    response_pages = 'response-page' in t or 'response pages' in t or 'response-pages' in t
    untrusted_hint = any(x in t for x in ['untrust', 'untrusted', 'internet', 'outside', 'wan'])

    if portal_enabled and response_pages and untrusted_hint:
        return 'exposed-likely'
    if portal_enabled:
        return 'enabled-unknown-reachability'
    return 'not-seen'


def main():
    args = parse_args()
    try:
        version, hostname = fetch_system_info(args.host, args.port, args.api_key, insecure=args.insecure)
        if not version:
            print('UNKNOWN - could not determine PAN-OS version')
            sys.exit(2)

        print(f'Host: {hostname}')
        print(f'PAN-OS version: {version}')

        if not is_version_in_scope(version):
            print('PATCHED - version branch not listed as affected for CVE-2026-0300')
            sys.exit(0)

        patched = is_version_patched(version)
        if patched is True:
            print('PATCHED - version is at or above a fixed release for its branch')
            sys.exit(0)

        # Vulnerable branch/build. Now try to infer whether the vulnerable portal path is configured.
        cfg = fetch_running_config(args.host, args.port, args.api_key, insecure=args.insecure)
        exposure = infer_portal_exposure(cfg)
        print(f'Exposure heuristic: {exposure}')

        if exposure == 'exposed-likely':
            print('VULNERABLE - affected version and portal appears enabled/reachable from untrusted context')
            sys.exit(1)
        elif exposure == 'enabled-unknown-reachability':
            print('UNKNOWN - affected version and portal appears enabled, but external reachability could not be proven from config export')
            sys.exit(2)
        elif exposure == 'not-seen':
            print('UNKNOWN - affected version, but Authentication Portal exposure was not detected in exported config')
            sys.exit(2)
        else:
            print('UNKNOWN - unable to classify exposure')
            sys.exit(2)

    except Exception as e:
        print(f'UNKNOWN - runtime error: {e}')
        sys.exit(3)


if __name__ == '__main__':
    main()