Docker Hub Account-to-Organization Conversion Silent PAT Transfer (GhostPat)

#!/usr/bin/env python3
"""CVE-2026-105445 (GhostPat) verification script.
Checks a Docker Hub account for PATs created during the exposure window
(Aug 26 2024 – Sep 30 2026) that may have been silently transferred.
Outputs: VULNERABLE / PATCHED / UNKNOWN
Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
"""
import sys
import json
try:
    import requests
except ImportError:
    print("UNKNOWN - 'requests' library not installed. Run: pip install requests")
    sys.exit(2)
from datetime import datetime, timezone

VULN_START = datetime(2024, 8, 26, tzinfo=timezone.utc)
VULN_END   = datetime(2026, 9, 30, 19, 10, 0, tzinfo=timezone.utc)
HUB_LOGIN  = "https://hub.docker.com/v2/users/login"
HUB_PATS   = "https://hub.docker.com/v2/access-tokens"

def main():
    if len(sys.argv) < 3:
        print("Usage: python verify_ghostpat.py <username> <password_or_pat>")
        sys.exit(2)

    username = sys.argv[1]
    password = sys.argv[2]

    # Authenticate to Docker Hub
    try:
        r = requests.post(HUB_LOGIN, json={"username": username, "password": password}, timeout=15)
    except requests.RequestException as e:
        print(f"UNKNOWN - HTTP error during login: {e}")
        sys.exit(2)

    if r.status_code != 200:
        print(f"UNKNOWN - Docker Hub login failed (HTTP {r.status_code}). Check credentials.")
        sys.exit(2)

    token = r.json().get("token", "")
    if not token:
        print("UNKNOWN - No token returned from Docker Hub login.")
        sys.exit(2)

    headers = {"Authorization": f"Bearer {token}"}

    # Fetch PATs
    try:
        r = requests.get(HUB_PATS, headers=headers, timeout=15)
    except requests.RequestException as e:
        print(f"UNKNOWN - HTTP error fetching PATs: {e}")
        sys.exit(2)

    if r.status_code != 200:
        print(f"UNKNOWN - Failed to list PATs (HTTP {r.status_code}). "
              f"API may require Docker Pro/Team/Business plan.")
        sys.exit(2)

    pats = r.json().get("results", [])
    if not pats:
        print("PATCHED - No personal access tokens found on this account.")
        sys.exit(0)

    suspicious = []
    for pat in pats:
        created_str = pat.get("created_at", "")
        is_active = pat.get("is_active", False)
        if not created_str:
            continue
        try:
            created = datetime.fromisoformat(created_str.replace("Z", "+00:00"))
        except ValueError:
            continue
        if VULN_START <= created <= VULN_END and is_active:
            suspicious.append({
                "uuid": pat.get("uuid", "N/A"),
                "description": pat.get("token_label", pat.get("description", "N/A")),
                "created": created_str,
                "scopes": pat.get("scopes", []),
                "last_used": pat.get("last_used", "never")
            })

    if suspicious:
        print("VULNERABLE - Active PATs found created during CVE-2026-105445 exposure window:")
        for s in suspicious:
            print(f"  UUID: {s['uuid']}  Label: {s['description']}  "
                  f"Created: {s['created']}  Scopes: {s['scopes']}  "
                  f"Last used: {s['last_used']}")
        print(f"\nAction: Review these {len(suspicious)} token(s). Revoke any you did not create.")
        print("Docker force-deactivated transferred PATs on Oct 8 2026, but opt-outs are possible.")
        sys.exit(1)
    else:
        print(f"PATCHED - {len(pats)} PAT(s) found, none active within the exposure window "
              f"(Aug 26 2024 - Sep 30 2026). Docker's server-side fix is in effect.")
        sys.exit(0)

if __name__ == "__main__":
    main()