SiteGuard Server Edition Statistics Feature OS Command Injection

#!/usr/bin/env bash
# check_cve_2026_106931.sh — Detect CVE-2026-106931 exposure
# SiteGuard Server Edition OS Command Injection (statistics feature)
# Run on target host as root or with sudo.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

SG_BASE="/opt/jp-secure/siteguardlite"
SG_CONF="${SG_BASE}/conf"
RESULT="UNKNOWN"

# Check if SiteGuard is installed
if [ ! -d "$SG_BASE" ]; then
  echo "[INFO] SiteGuard Server Edition not found at $SG_BASE"
  echo "[INFO] Checking for Windows-style install or alternative paths..."
  # Check common alternative locations
  for alt in /usr/local/jp-secure/siteguardlite /opt/jp-secure/siteguard; do
    if [ -d "$alt" ]; then
      SG_BASE="$alt"
      SG_CONF="${SG_BASE}/conf"
      echo "[INFO] Found SiteGuard at $SG_BASE"
      break
    fi
  done
  if [ ! -d "$SG_BASE" ]; then
    echo "UNKNOWN — SiteGuard Server Edition not detected on this host."
    exit 2
  fi
fi

# Attempt to extract version
VERSION=""
if [ -f "${SG_BASE}/version" ]; then
  VERSION=$(cat "${SG_BASE}/version" 2>/dev/null | head -1)
elif command -v "${SG_BASE}/bin/siteguardlite_ctl" &>/dev/null; then
  VERSION=$("${SG_BASE}/bin/siteguardlite_ctl" version 2>/dev/null | grep -oP '[0-9]+\.[0-9]+[^\s]*' | head -1)
fi

if [ -z "$VERSION" ]; then
  # Try extracting from package manager
  if command -v rpm &>/dev/null; then
    VERSION=$(rpm -qa 2>/dev/null | grep -i siteguard | head -1)
  elif command -v dpkg &>/dev/null; then
    VERSION=$(dpkg -l 2>/dev/null | grep -i siteguard | awk '{print $3}' | head -1)
  fi
fi

echo "[INFO] SiteGuard install path: $SG_BASE"
echo "[INFO] Detected version: ${VERSION:-unknown}"

# Check if statistics feature is enabled
STATS_ENABLED="unknown"
for conf_file in "${SG_CONF}/siteguardlite.ini" "${SG_CONF}/httpd.conf.siteguard" "${SG_BASE}/conf.d/"*.conf; do
  if [ -f "$conf_file" ] 2>/dev/null; then
    if grep -qi 'stats\|statistics' "$conf_file" 2>/dev/null; then
      if grep -qiP '(stats|statistics).*(off|disable|false|0)' "$conf_file" 2>/dev/null; then
        STATS_ENABLED="disabled"
      else
        STATS_ENABLED="enabled"
      fi
    fi
  fi
done

echo "[INFO] Statistics feature: $STATS_ENABLED (default is enabled)"

# Version comparison — fixed versions:
# Apache/Nginx/IIS: 8.00 Update 5
# FreeBSD: 7.00 Update 6
# Affected: >= 2.20 and < fixed version
#
# Simple heuristic: if version string contains "8.00" with update >= 5, PATCHED
# If version contains "7.00" with update >= 6 (FreeBSD), PATCHED
# If version >= 8.01 or >= 9.x, PATCHED

if [ -n "$VERSION" ]; then
  # Normalize: check for known patched patterns
  if echo "$VERSION" | grep -qiP '8\.00.*update\s*[5-9]'; then
    RESULT="PATCHED"
  elif echo "$VERSION" | grep -qiP '8\.00.*up(date)?\s*[5-9]'; then
    RESULT="PATCHED"
  elif echo "$VERSION" | grep -qiP '(8\.0[1-9]|8\.[1-9]|9\.|[1-9][0-9]\.)'; then
    RESULT="PATCHED"
  elif echo "$VERSION" | grep -qiP '7\.00.*update\s*[6-9]'; then
    # FreeBSD patched version
    RESULT="PATCHED"
  elif echo "$VERSION" | grep -qiP '([2-7]\.|8\.00)'; then
    RESULT="VULNERABLE"
  else
    RESULT="UNKNOWN"
  fi
else
  # Cannot determine version; check if stats is disabled as mitigating factor
  if [ "$STATS_ENABLED" = "disabled" ]; then
    echo "[INFO] Statistics feature appears disabled — attack surface mitigated."
    RESULT="UNKNOWN"
  else
    RESULT="UNKNOWN"
  fi
fi

# Final output
echo ""
if [ "$RESULT" = "VULNERABLE" ]; then
  echo "VULNERABLE — CVE-2026-106931: SiteGuard $VERSION with statistics ${STATS_ENABLED}."
  echo "[ACTION] Patch to Ver 8.00 Update 5 (or 7.00 Update 6 on FreeBSD) immediately."
  echo "[ACTION] As interim mitigation, disable the statistics feature."
  exit 1
elif [ "$RESULT" = "PATCHED" ]; then
  echo "PATCHED — SiteGuard $VERSION is at or above the fixed version."
  exit 0
else
  echo "UNKNOWN — Could not definitively determine vulnerability status."
  echo "[ACTION] Manually verify SiteGuard version and statistics feature status."
  exit 2
fi