FortiSandbox GUI Authentication Bypass via Alternate Path

#!/usr/bin/env bash
# check_cve_2026_107656.sh — Detect CVE-2026-107656 on FortiSandbox
# Usage: ./check_cve_2026_107656.sh <IP_OR_HOSTNAME> [SSH_USER]
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

TARGET="${1:?Usage: $0 <FortiSandbox_IP> [ssh_user]}"
SSH_USER="${2:-admin}"
TIMEOUT=10

# Grab firmware version via CLI 'status' command
RAW=$(ssh -o ConnectTimeout="$TIMEOUT" -o StrictHostKeyChecking=accept-new \
  "${SSH_USER}@${TARGET}" 'execute status' 2>/dev/null) || {
  echo "UNKNOWN — SSH connection to ${TARGET} failed. Verify connectivity and credentials."
  exit 2
}

# Parse version string (e.g., "FortiSandbox-VM64 v5.0.6 build0234")
VERSION=$(echo "$RAW" | grep -ioP 'v\K[0-9]+\.[0-9]+\.[0-9]+' | head -1)

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — Could not parse FortiSandbox version from output."
  echo "Raw output (first 5 lines):"
  echo "$RAW" | head -5
  exit 2
fi

MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

echo "Detected FortiSandbox version: ${VERSION}"

# 5.2.x and above — not affected
if (( MAJOR > 5 )) || (( MAJOR == 5 && MINOR >= 2 )); then
  echo "PATCHED — Version ${VERSION} is in the 5.2+ branch (not affected)."
  exit 0
fi

# 5.0.x branch — vulnerable if < 5.0.7
if (( MAJOR == 5 && MINOR == 0 )); then
  if (( PATCH >= 7 )); then
    echo "PATCHED — Version ${VERSION} is >= 5.0.7."
    exit 0
  else
    echo "VULNERABLE — Version ${VERSION} is in the affected range 5.0.0-5.0.6. Upgrade to 5.0.7+."
    exit 1
  fi
fi

# 4.4.x branch — vulnerable if < 4.4.10
if (( MAJOR == 4 && MINOR == 4 )); then
  if (( PATCH >= 10 )); then
    echo "PATCHED — Version ${VERSION} is >= 4.4.10."
    exit 0
  else
    echo "VULNERABLE — Version ${VERSION} is in the affected range 4.4.0-4.4.9. Upgrade to 4.4.10+."
    exit 1
  fi
fi

# 5.1.x — unclear, treat as unknown
if (( MAJOR == 5 && MINOR == 1 )); then
  echo "UNKNOWN — Version ${VERSION} (5.1.x) is not referenced in FG-IR-26-185. Verify with Fortinet."
  exit 2
fi

# Anything older than 4.4 — likely EOL and not listed, but may still be vulnerable
if (( MAJOR < 4 )) || (( MAJOR == 4 && MINOR < 4 )); then
  echo "UNKNOWN — Version ${VERSION} predates the affected range. May be EOL. Verify with Fortinet."
  exit 2
fi

echo "UNKNOWN — Version ${VERSION} could not be classified. Manual review required."
exit 2