Ivanti Connect Secure Authentication Bypass by Spoofing Leading to Unauthenticated RCE

#!/usr/bin/env python3
"""CVE-2026-104935 Vulnerability Checker for Ivanti Connect Secure.
Non-destructive version-based check. Does NOT attempt exploitation.
Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN
"""
import sys
import ssl
import re
import urllib.request
import urllib.error

def get_ics_version(target_url):
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE
    urls = [
        f"{target_url}/dana-na/auth/url_default/welcome.cgi",
        f"{target_url}/dana-na/auth/url_0/welcome.cgi",
        f"{target_url}/",
    ]
    for url in urls:
        try:
            req = urllib.request.Request(url, headers={"User-Agent": "noisgate-checker/1.0"})
            resp = urllib.request.urlopen(req, timeout=15, context=ctx)
            body = resp.read().decode("utf-8", errors="replace")
            hdrs = dict(resp.getheaders())
            for pat in [
                r'version["\s:=]+(\d+\.\d+(?:\.\d+)*(?:R\d+(?:\.\d+)*)?)',
                r'(25\.\d+\.\d+\.\d+)',
                r'(22\.\d+R\d+\.\d+)',
            ]:
                m = re.search(pat, body, re.IGNORECASE)
                if m:
                    return m.group(1)
            srv = hdrs.get("Server", "")
            if any(k in srv for k in ("ICS", "Ivanti", "Pulse")):
                m = re.search(r'(\d+\.\d+(?:\.\d+)*(?:R\d+(?:\.\d+)*)?)', srv)
                if m:
                    return m.group(1)
            if "welcome.cgi" in url and resp.status == 200:
                return "ICS_DETECTED_NO_VERSION"
        except (urllib.error.URLError, urllib.error.HTTPError, OSError):
            continue
    return None

def is_vulnerable(v):
    if v == "ICS_DETECTED_NO_VERSION":
        return None
    # 22.xRy.z
    m = re.match(r'22\.(\d+)R(\d+)\.(\d+)', v)
    if m:
        minor, rel, patch = int(m.group(1)), int(m.group(2)), int(m.group(3))
        if minor <= 7:
            return False          # 22.7 and below unaffected
        if minor == 8 and rel == 2:
            return patch <= 4     # 22.8R2.4 and prior vuln; .5 fixed
        return None
    # 25.x.y.z
    m = re.match(r'25\.(\d+)\.(\d+)\.(\d+)', v)
    if m:
        mi, mc, pa = int(m.group(1)), int(m.group(2)), int(m.group(3))
        if mi > 1:
            return False
        if mi == 1:
            if mc >= 3:
                return False      # 25.1.3.0+ fixed
            if mc == 1:
                return pa <= 1    # 25.1.1.1 vuln; .2 fixed
            if mc == 2:
                return pa <= 2    # 25.1.2.2 vuln
            return True
    return None

def main():
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <https://ics-appliance-url>")
        print(f"Example: {sys.argv[0]} https://vpn.company.com")
        sys.exit(2)
    target = sys.argv[1].rstrip("/")
    if not target.startswith("http"):
        target = f"https://{target}"
    print(f"[*] CVE-2026-104935 Checker - Ivanti Connect Secure")
    print(f"[*] Target: {target}")
    print()
    ver = get_ics_version(target)
    if ver is None:
        print("[?] Could not detect Ivanti Connect Secure on target.")
        print("UNKNOWN")
        sys.exit(2)
    if ver == "ICS_DETECTED_NO_VERSION":
        print("[!] ICS detected but version not extractable.")
        print("[!] Check manually against fixed: 25.1.3.0, 25.1.1.2, 22.8R2.5")
        print("UNKNOWN")
        sys.exit(2)
    print(f"[+] Detected version: {ver}")
    result = is_vulnerable(ver)
    if result is True:
        print(f"[!] {ver} is VULNERABLE to CVE-2026-104935")
        print("[!] Upgrade immediately to 25.1.3.0+ / 25.1.1.2+ / 22.8R2.5+")
        print("VULNERABLE")
        sys.exit(1)
    elif result is False:
        print(f"[+] {ver} is PATCHED for CVE-2026-104935")
        print("PATCHED")
        sys.exit(0)
    else:
        print(f"[?] {ver} not matched to known ranges.")
        print("[?] Fixed: 25.1.3.0, 25.1.1.2, 22.8R2.5")
        print("UNKNOWN")
        sys.exit(2)

if __name__ == "__main__":
    main()