NetScaler ADC/Gateway Pre-Authentication Remote Code Execution via SAML Memory Overflow

#!/bin/bash
# CVE-2026-107406 Vulnerability Checker for NetScaler ADC/Gateway
# Run on the NetScaler appliance as nsroot via SSH
# Output: VULNERABLE / PATCHED / UNKNOWN

set -euo pipefail

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

echo "=== CVE-2026-107406 Check ==="
echo "Checking NetScaler build version and SAML configuration..."
echo ""

# Get version info
VERSION_OUTPUT=$(nsapimgr_wr.sh -ys call=ns_get_version 2>/dev/null || cat /var/nsinstall/build_version 2>/dev/null || echo "UNKNOWN")

# Try to parse major.minor-build format
if echo "$VERSION_OUTPUT" | grep -qoE '[0-9]+\.[0-9]+-[0-9]+\.[0-9]+'; then
  BUILD_STRING=$(echo "$VERSION_OUTPUT" | grep -oE '[0-9]+\.[0-9]+-[0-9]+\.[0-9]+' | head -1)
  MAJOR_MINOR=$(echo "$BUILD_STRING" | cut -d'-' -f1)
  BUILD_NUM=$(echo "$BUILD_STRING" | cut -d'-' -f2)
  echo "Detected build: $BUILD_STRING"
else
  echo -e "${YELLOW}UNKNOWN — Could not parse NetScaler version. Verify manually with 'show ns version'.${NC}"
  exit 2
fi

# Check SAML configuration
SAML_SP=false
SAML_IDP=false
NSCONF="/nsconfig/ns.conf"

if [ -f "$NSCONF" ]; then
  if grep -q 'add authentication samlAction' "$NSCONF" 2>/dev/null; then
    SAML_SP=true
    echo "SAML Service Provider (SP): CONFIGURED"
  fi
  if grep -q 'add authentication samlIdPProfile' "$NSCONF" 2>/dev/null; then
    SAML_IDP=true
    echo "SAML Identity Provider (IdP): CONFIGURED"
  fi
  if [ "$SAML_SP" = false ] && [ "$SAML_IDP" = false ]; then
    echo "SAML configuration: NOT FOUND"
    echo ""
    echo -e "${GREEN}PATCHED — No SAML SP or IdP configuration detected. This appliance is not affected by CVE-2026-107406.${NC}"
    exit 0
  fi
else
  echo -e "${YELLOW}WARNING: Cannot read $NSCONF — assuming SAML may be configured.${NC}"
  SAML_SP=true
  SAML_IDP=true
fi

echo ""

# Version comparison logic
compare_build() {
  local major_minor="$1"
  local build="$2"
  local fix_build="$3"
  # Compare build numbers as floating point
  echo "$build $fix_build" | awk '{if ($1 >= $2) print "FIXED"; else print "VULN"}'
}

case "$MAJOR_MINOR" in
  14.1)
    RESULT=$(compare_build "14.1" "$BUILD_NUM" "73.46")
    if [ "$RESULT" = "FIXED" ]; then
      echo -e "${GREEN}PATCHED — Build $BUILD_STRING is at or above the fixed version 14.1-73.46.${NC}"
      exit 0
    else
      # Check if in IdP-only range (73.37-73.41) or older (SP+IdP)
      IN_IDP_RANGE=$(echo "$BUILD_NUM" | awk '{if ($1 >= 73.37 && $1 <= 73.41) print "YES"; else print "NO"}')
      if [ "$IN_IDP_RANGE" = "YES" ]; then
        if [ "$SAML_IDP" = true ]; then
          echo -e "${RED}VULNERABLE — Build $BUILD_STRING is in the 73.37-73.41 range with SAML IdP configured. Upgrade to 14.1-73.46+.${NC}"
          exit 1
        else
          echo -e "${GREEN}PATCHED — Build $BUILD_STRING is in the IdP-only vulnerable range but no SAML IdP is configured.${NC}"
          exit 0
        fi
      else
        echo -e "${RED}VULNERABLE — Build $BUILD_STRING is below 14.1-73.37 with SAML configured (SP and/or IdP). Upgrade to 14.1-73.46+.${NC}"
        exit 1
      fi
    fi
    ;;
  13.1)
    RESULT=$(compare_build "13.1" "$BUILD_NUM" "64.29")
    if [ "$RESULT" = "FIXED" ]; then
      echo -e "${GREEN}PATCHED — Build $BUILD_STRING is at or above the fixed version 13.1-64.29.${NC}"
      exit 0
    else
      IN_IDP_RANGE=$(echo "$BUILD_NUM" | awk '{if ($1 >= 64.23 && $1 <= 64.28) print "YES"; else print "NO"}')
      if [ "$IN_IDP_RANGE" = "YES" ]; then
        if [ "$SAML_IDP" = true ]; then
          echo -e "${RED}VULNERABLE — Build $BUILD_STRING is in the 64.23-64.28 range with SAML IdP configured. Upgrade to 13.1-64.29+.${NC}"
          exit 1
        else
          echo -e "${GREEN}PATCHED — Build $BUILD_STRING is in the IdP-only vulnerable range but no SAML IdP is configured.${NC}"
          exit 0
        fi
      else
        echo -e "${RED}VULNERABLE — Build $BUILD_STRING is below 13.1-64.23 with SAML configured (SP and/or IdP). Upgrade to 13.1-64.29+.${NC}"
        exit 1
      fi
    fi
    ;;
  12.1|13.0)
    echo -e "${RED}VULNERABLE — Build $BUILD_STRING is END-OF-LIFE with no patch available. Migrate to a supported branch immediately.${NC}"
    exit 1
    ;;
  *)
    echo -e "${YELLOW}UNKNOWN — Unrecognized NetScaler version $MAJOR_MINOR. Verify manually.${NC}"
    exit 2
    ;;
esac