AhsayCBS Replication Receiver Unauthenticated OS Command Injection via Path Traversal

#!/usr/bin/env bash
# check_ahsaycbs_cve2026105134.sh — CVE-2026-105134 local version checker
# Usage: bash check_ahsaycbs_cve2026105134.sh <CBS_INSTALL_DIR>
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

CBS_DIR="${1:-}"
if [[ -z "$CBS_DIR" ]]; then
  echo "Usage: $0 <CBS_INSTALL_DIR>"
  echo "  e.g. $0 /opt/ahsaycbs"
  echo "  e.g. $0 /c/AhsayCBS"
  exit 2
fi

# Look for version info in known locations
VERSION_FILE=""
for candidate in \
  "$CBS_DIR/system/version.txt" \
  "$CBS_DIR/system/conf/version.properties" \
  "$CBS_DIR/conf/version.txt" \
  "$CBS_DIR/version.txt"; do
  if [[ -f "$candidate" ]]; then
    VERSION_FILE="$candidate"
    break
  fi
done

if [[ -z "$VERSION_FILE" ]]; then
  echo "[UNKNOWN] Could not locate AhsayCBS version file in $CBS_DIR"
  echo "  Manually check: CBS Admin Console > About, or look for version.txt"
  exit 2
fi

VERSION_RAW=$(cat "$VERSION_FILE" | grep -iE '(version|build)' | head -5)
echo "Detected version info from $VERSION_FILE:"
echo "$VERSION_RAW"
echo "---"

# Extract version number (e.g., 10.3.4.45 or 9.15.2.70)
VER=$(echo "$VERSION_RAW" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+(\.[0-9]+)?' | head -1)

if [[ -z "$VER" ]]; then
  echo "[UNKNOWN] Could not parse version number from $VERSION_FILE"
  exit 2
fi

echo "Parsed version: $VER"

# Version comparison function
version_gte() {
  # Returns 0 if $1 >= $2
  printf '%s\n%s' "$2" "$1" | sort -t. -k1,1n -k2,2n -k3,3n -k4,4n -C
}

MAJOR=$(echo "$VER" | cut -d. -f1)

if [[ "$MAJOR" -ge 10 ]]; then
  # v10 branch: need >= 10.3.4.45
  if version_gte "$VER" "10.3.4.45"; then
    echo "[PATCHED] AhsayCBS $VER >= 10.3.4.45 — CVE-2026-105134 is fixed."
    exit 0
  else
    echo "[VULNERABLE] AhsayCBS $VER < 10.3.4.45 — CVE-2026-105134 applies!"
    echo "  Action: Apply hotfix 10.3.4.45 immediately and reboot."
    exit 1
  fi
elif [[ "$MAJOR" -ge 7 ]]; then
  # v7-v9 branch: need >= 9.15.2.70
  if version_gte "$VER" "9.15.2.70"; then
    echo "[PATCHED] AhsayCBS $VER >= 9.15.2.70 — CVE-2026-105134 is fixed."
    exit 0
  else
    echo "[VULNERABLE] AhsayCBS $VER < 9.15.2.70 — CVE-2026-105134 applies!"
    echo "  Action: Upgrade to 9.15.0.0 (if on v7/v8), then apply hotfix 9.15.2.70."
    exit 1
  fi
else
  echo "[UNKNOWN] AhsayCBS major version $MAJOR is outside known affected range (v7-v10)."
  exit 2
fi

# Also check for webshell IOCs
echo "\n--- IOC Check ---"
WEBSHELL_FOUND=0
for webdir in "$CBS_DIR/webapps/rps" "$CBS_DIR/webapps/obs"; do
  if [[ -d "$webdir" ]]; then
    SUSPECT=$(find "$webdir" -name '*.jsp' -newer "$webdir/WEB-INF/web.xml" 2>/dev/null || true)
    if [[ -n "$SUSPECT" ]]; then
      echo "[WARNING] Suspicious JSP files newer than web.xml in $webdir:"
      echo "$SUSPECT"
      WEBSHELL_FOUND=1
    fi
  fi
done
if [[ $WEBSHELL_FOUND -eq 0 ]]; then
  echo "No suspicious JSP files detected in webapps directories."
fi