BeyondTrust Remote Support Improper Origin Validation Leading to Unauthenticated Arbitrary File Operations

#!/usr/bin/env bash
# check_cve_2026_102764.sh — BeyondTrust Remote Support CVE-2026-102764 checker
# Usage: bash check_cve_2026_102764.sh <appliance-fqdn>
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <appliance-fqdn>"
  exit 2
fi

TARGET="$1"
URL="https://${TARGET}/login"

echo "[*] Checking BeyondTrust Remote Support at ${TARGET}..."

# Fetch login page and look for version string
RESPONSE=$(curl -sk --connect-timeout 10 --max-time 15 "${URL}" 2>/dev/null || true)

if [ -z "$RESPONSE" ]; then
  echo "[!] Could not reach ${URL}"
  echo "UNKNOWN"
  exit 2
fi

# BeyondTrust RS login pages typically expose version in page source or headers
# Look for version patterns like 26.2.3, 24.3.1, etc.
VERSION=$(echo "$RESPONSE" | grep -oP '(?:version|build|product.version)[":\s]*([0-9]+\.[0-9]+\.[0-9]+)' | grep -oP '[0-9]+\.[0-9]+\.[0-9]+' | head -1)

# Also check Server header and X-headers
HEADERS=$(curl -skI --connect-timeout 10 --max-time 15 "${URL}" 2>/dev/null || true)
HDR_VERSION=$(echo "$HEADERS" | grep -oiP '(?:x-app-version|x-build)[:\s]*([0-9]+\.[0-9]+\.[0-9]+)' | grep -oP '[0-9]+\.[0-9]+\.[0-9]+' | head -1)

DETECTED_VERSION="${VERSION:-$HDR_VERSION}"

if [ -z "$DETECTED_VERSION" ]; then
  echo "[!] Could not extract version from login page."
  echo "[*] Manual check required: log into ${TARGET}/appliance and check Status > Software Version."
  echo "[*] Vulnerable if version <= 26.2.3 without BT26-05-RS patch."
  echo "UNKNOWN"
  exit 2
fi

echo "[*] Detected version: ${DETECTED_VERSION}"

# Compare versions — vulnerable if <= 26.2.3
# Note: presence of version alone doesn't confirm patch status;
# BT26-05-RS is a hotfix that may not change the base version string.
IFS='.' read -r MAJ MIN PAT <<< "$DETECTED_VERSION"

if [ "$MAJ" -lt 24 ]; then
  echo "[!] Version ${DETECTED_VERSION} is BELOW supported range (24.3.1+)."
  echo "[!] No patch available for this version — upgrade required."
  echo "VULNERABLE"
  exit 1
elif [ "$MAJ" -eq 24 ] && [ "$MIN" -lt 3 ]; then
  echo "[!] Version ${DETECTED_VERSION} is BELOW supported range (24.3.1+)."
  echo "VULNERABLE"
  exit 1
elif [ "$MAJ" -gt 26 ]; then
  echo "[+] Version ${DETECTED_VERSION} is above the affected range."
  echo "PATCHED"
  exit 0
elif [ "$MAJ" -eq 26 ] && [ "$MIN" -gt 2 ]; then
  echo "[+] Version ${DETECTED_VERSION} is above 26.2.x — likely patched."
  echo "PATCHED"
  exit 0
elif [ "$MAJ" -eq 26 ] && [ "$MIN" -eq 2 ] && [ "$PAT" -gt 3 ]; then
  echo "[+] Version ${DETECTED_VERSION} is above 26.2.3 — likely patched."
  echo "PATCHED"
  exit 0
else
  echo "[!] Version ${DETECTED_VERSION} is in the vulnerable range (<= 26.2.3)."
  echo "[!] Check /appliance > Updates to confirm BT26-05-RS patch is installed."
  echo "[*] If BT26-05-RS is listed in installed patches, the appliance is PATCHED."
  echo "[*] If BT26-05-RS is NOT listed, the appliance is VULNERABLE."
  echo "VULNERABLE"
  exit 1
fi