An improper limitation of a pathname to a restricted directory

#!/usr/bin/env bash
# check_cve-2026-104286.sh — FortiMail path traversal (CVE-2026-104286) version check
# Usage: bash check_cve-2026-104286.sh <fortimail_host> [ssh_port]
# Requires: SSH access to FortiMail admin CLI
# Outputs: VULNERABLE / PATCHED / UNKNOWN

set -euo pipefail

HOST="${1:-}"
PORT="${2:-22}"

if [[ -z "$HOST" ]]; then
  echo "Usage: $0 <fortimail_host> [ssh_port]"
  exit 3
fi

# Grab system status from FortiMail CLI
STATUS=$(ssh -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new -p "$PORT" admin@"$HOST" "get system status" 2>/dev/null) || {
  echo "UNKNOWN — SSH connection to $HOST:$PORT failed"
  exit 2
}

# Extract version string (e.g., "v7.6.5")
VERSION=$(echo "$STATUS" | grep -i 'Version' | head -1 | grep -oP 'v[0-9]+\.[0-9]+\.[0-9]+' | head -1)

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — could not parse FortiMail version from output"
  exit 2
fi

# Strip leading 'v'
VER="${VERSION#v}"
MAJOR=$(echo "$VER" | cut -d. -f1)
MINOR=$(echo "$VER" | cut -d. -f2)
PATCH=$(echo "$VER" | cut -d. -f3)

echo "Detected FortiMail version: $VERSION"

# Check IBE status
IBE_STATUS=$(ssh -o ConnectTimeout=10 -p "$PORT" admin@"$HOST" "show system encryption ibe" 2>/dev/null) || true
if echo "$IBE_STATUS" | grep -qi 'disable'; then
  IBE_ENABLED="no"
  echo "IBE status: DISABLED (mitigated)"
else
  IBE_ENABLED="yes"
  echo "IBE status: ENABLED (vulnerable endpoint reachable)"
fi

# Version comparison
# Vulnerable ranges:
#   8.0.0 - 8.0.1  (fixed: 8.0.2)
#   7.6.0 - 7.6.6  (fixed: 7.6.7)
#   7.4.0 - 7.4.8  (fixed: 7.4.9)
#   7.2.0 - 7.2.9  (no fix, must migrate)

VULN="no"

if [[ "$MAJOR" -eq 8 && "$MINOR" -eq 0 ]]; then
  if [[ "$PATCH" -le 1 ]]; then
    VULN="yes"
    FIX="8.0.2"
  fi
elif [[ "$MAJOR" -eq 7 && "$MINOR" -eq 6 ]]; then
  if [[ "$PATCH" -le 6 ]]; then
    VULN="yes"
    FIX="7.6.7"
  fi
elif [[ "$MAJOR" -eq 7 && "$MINOR" -eq 4 ]]; then
  if [[ "$PATCH" -le 8 ]]; then
    VULN="yes"
    FIX="7.4.9"
  fi
elif [[ "$MAJOR" -eq 7 && "$MINOR" -eq 2 ]]; then
  VULN="yes"
  FIX="7.4.9+ (7.2.x has no fix; must migrate)"
elif [[ "$MAJOR" -eq 7 && "$MINOR" -le 1 ]]; then
  # 7.0.x and earlier — check if in vulnerable range per some sources
  VULN="yes"
  FIX="7.4.9+ (must migrate)"
fi

# Also check for IOCs
echo ""
echo "--- IOC spot check ---"
IOC_CHECK=$(ssh -o ConnectTimeout=10 -p "$PORT" admin@"$HOST" "fnsysctl ls /data/lib/liblog.so" 2>/dev/null) || IOC_CHECK=""
if echo "$IOC_CHECK" | grep -q 'liblog.so'; then
  echo "WARNING: /data/lib/liblog.so EXISTS — possible compromise indicator!"
else
  echo "No liblog.so IOC found (good)"
fi

IOC_PRELOAD=$(ssh -o ConnectTimeout=10 -p "$PORT" admin@"$HOST" "fnsysctl cat /data/etc/ld.so.preload" 2>/dev/null) || IOC_PRELOAD=""
if [[ -n "$IOC_PRELOAD" ]] && echo "$IOC_PRELOAD" | grep -q 'liblog'; then
  echo "WARNING: ld.so.preload references liblog — LIKELY COMPROMISED!"
else
  echo "No ld.so.preload IOC found (good)"
fi

echo ""

if [[ "$VULN" == "yes" ]]; then
  if [[ "$IBE_ENABLED" == "no" ]]; then
    echo "VULNERABLE (version $VERSION is affected, but IBE is disabled — attack surface mitigated)"
    echo "Recommended: upgrade to $FIX when available"
    exit 1
  else
    echo "VULNERABLE — FortiMail $VERSION is in the affected range and IBE is ENABLED"
    echo "IMMEDIATE ACTION: disable IBE or restrict GUI access. Upgrade to $FIX"
    exit 1
  fi
else
  echo "PATCHED — FortiMail $VERSION is not in the vulnerable range"
  exit 0
fi