ASP.NET Core Blazor WebAssembly debug proxy code injection via unescaped expression evaluation

#Requires -Version 5.1
<#
  Check-CVE2026102870.ps1
  Detects vulnerable Blazor WebAssembly debug proxy (CVE-2026-102870)
  Exit 0 = PATCHED, Exit 1 = VULNERABLE, Exit 2 = UNKNOWN
#>
param([string]$SearchPath = '.')

$VulnPkgs = @(
  'Microsoft.AspNetCore.Components.WebAssembly.Server',
  'Microsoft.AspNetCore.Components.WebAssembly.DevServer'
)
$SafeVer10 = [version]'10.0.14'
$found = $false
$vuln  = $false

# --- Check 1: .NET SDK version ---
Write-Host '[*] Checking installed .NET SDKs...'
try {
  $sdks = & dotnet --list-sdks 2>$null
  foreach ($line in $sdks) {
    if ($line -match '^(10\.0\.(\d+))') {
      $found = $true
      $sdkPatch = [int]$Matches[2]
      # SDK 10.0.114 ships runtime 10.0.14; SDK patch >= 403 also maps to fixed runtime
      if ($sdkPatch -lt 114 -and $sdkPatch -lt 403) {
        Write-Host "[!] VULNERABLE SDK: $($Matches[1])" -ForegroundColor Red
        $vuln = $true
      } else {
        Write-Host "[+] Patched SDK: $($Matches[1])" -ForegroundColor Green
      }
    }
    if ($line -match '^(11\.0\.0-(preview|rc\.[12]))') {
      $found = $true
      Write-Host "[!] VULNERABLE SDK (pre-rc.3): $($Matches[1])" -ForegroundColor Red
      $vuln = $true
    }
  }
} catch { Write-Host '[?] dotnet CLI not found' -ForegroundColor Yellow }

# --- Check 2: NuGet package references in project files ---
Write-Host "`n[*] Scanning project files under $SearchPath ..."
$projs = Get-ChildItem -Path $SearchPath -Recurse -Include '*.csproj','*.fsproj','*.vbproj' -ErrorAction SilentlyContinue
foreach ($p in $projs) {
  try {
    [xml]$xml = Get-Content $p.FullName -ErrorAction Stop
    foreach ($ref in $xml.SelectNodes('//PackageReference')) {
      $name = $ref.GetAttribute('Include')
      $ver  = $ref.GetAttribute('Version')
      if ($VulnPkgs -contains $name -and $ver) {
        $found = $true
        $clean = $ver -replace '-.*',''
        if ($ver -match '^10\.' -and [version]$clean -lt $SafeVer10) {
          Write-Host "[!] VULNERABLE: $($p.FullName) -> $name $ver" -ForegroundColor Red
          $vuln = $true
        } elseif ($ver -match '^11\.0\.0-(preview|rc\.[12])') {
          Write-Host "[!] VULNERABLE: $($p.FullName) -> $name $ver" -ForegroundColor Red
          $vuln = $true
        } else {
          Write-Host "[+] OK: $($p.FullName) -> $name $ver" -ForegroundColor Green
        }
      }
    }
  } catch {}
}

# --- Verdict ---
Write-Host ''
if (-not $found) {
  Write-Host 'UNKNOWN - No .NET 10/11 SDK or Blazor WASM package references found' -ForegroundColor Yellow
  exit 2
} elseif ($vuln) {
  Write-Host 'VULNERABLE - CVE-2026-102870: Update SDK to 10.0.14+ and NuGet packages' -ForegroundColor Red
  exit 1
} else {
  Write-Host 'PATCHED - No vulnerable Blazor WASM debug proxy versions detected' -ForegroundColor Green
  exit 0
}