Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code…

#!/usr/bin/env bash
# CVE-2026-102489 — Zammad Session Hijack → RCE version check + IoC scan
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=VULNERABLE+IoC, 3=UNKNOWN

set -uo pipefail

ZAMMAD_DIR="${1:-/opt/zammad}"
VULN_MIN="6.3.0"
VULN_MAX="6.5.4"
RESULT="UNKNOWN"
IOC_FOUND=0

# --- Version detection ---
VERSION=""
if [[ -f "$ZAMMAD_DIR/VERSION" ]]; then
    VERSION=$(tr -d '[:space:]' < "$ZAMMAD_DIR/VERSION")
elif command -v zammad &>/dev/null; then
    VERSION=$(zammad version 2>/dev/null | grep -oP '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)
fi

if [[ -z "$VERSION" ]]; then
    echo "UNKNOWN — Cannot determine Zammad version."
    echo "Checked: $ZAMMAD_DIR/VERSION and 'zammad version' command."
    echo "If Zammad is installed elsewhere, pass the path as an argument."
    exit 3
fi

echo "[*] Detected Zammad version: $VERSION"

# --- Version comparison (sort -V based) ---
ver_gte() { printf '%s\n%s\n' "$2" "$1" | sort -V -C; }
ver_lte() { printf '%s\n%s\n' "$1" "$2" | sort -V -C; }

if ver_gte "$VERSION" "$VULN_MIN" && ver_lte "$VERSION" "$VULN_MAX"; then
    RESULT="VULNERABLE"
    echo "[!] VULNERABLE — Zammad $VERSION is in the affected range ($VULN_MIN – $VULN_MAX)"
    echo "    Remediation: Upgrade to Zammad 7.x immediately."
elif ver_gte "$VERSION" "7.0.0" && ver_lte "$VERSION" "7.1.3"; then
    RESULT="PATCHED"
    echo "[+] PATCHED — Zammad $VERSION contains the code but is NOT exploitable (environmental conditions)."
elif ver_gte "$VERSION" "7.1.4"; then
    RESULT="PATCHED"
    echo "[+] PATCHED — Zammad $VERSION is beyond all affected ranges."
else
    RESULT="PATCHED"
    echo "[+] PATCHED — Zammad $VERSION is below the affected range (< $VULN_MIN)."
fi

# --- IoC check (DIVD indicators) ---
echo ""
echo "[*] Checking for known IoCs (DIVD-2026-00015)..."

for LOGDIR in /var/log/zammad /var/log/nginx; do
    if [[ -d "$LOGDIR" ]] && [[ -r "$LOGDIR" ]]; then
        # Check for session material exposure in logs
        HITS=$(grep -rl '"Cookie"=>' "$LOGDIR" 2>/dev/null | head -5 || true)
        if [[ -n "$HITS" ]]; then
            echo "[!!] IoC DETECTED — Session cookie exposure in $LOGDIR:"
            echo "$HITS"
            IOC_FOUND=1
        fi
        HITS2=$(grep -rl '@clients={}' "$LOGDIR" 2>/dev/null | head -5 || true)
        if [[ -n "$HITS2" ]]; then
            echo "[!!] IoC DETECTED — @clients={} pattern in $LOGDIR:"
            echo "$HITS2"
            IOC_FOUND=1
        fi
    else
        echo "[~] Skipped $LOGDIR (not found or not readable — run as root for full IoC check)"
    fi
done

if [[ $IOC_FOUND -eq 1 ]]; then
    echo ""
    echo "[!!] INDICATORS OF COMPROMISE FOUND — Investigate immediately."
    echo "    Refer to DIVD-2026-00015: https://csirt.divd.nl/cases/DIVD-2026-00015/"
else
    echo "[+] No known IoCs detected in accessible log files."
fi

# --- Final output ---
echo ""
if [[ "$RESULT" == "VULNERABLE" ]] && [[ $IOC_FOUND -eq 1 ]]; then
    echo "VULNERABLE (with IoC hits — possible active compromise)"
    exit 2
elif [[ "$RESULT" == "VULNERABLE" ]]; then
    echo "VULNERABLE"
    exit 1
elif [[ "$RESULT" == "PATCHED" ]]; then
    echo "PATCHED"
    exit 0
else
    echo "UNKNOWN"
    exit 3
fi