Imperia CMS SiteActive TEMPLATE unauthenticated SSTI remote code execution via PHPExec postconverter

#!/usr/bin/env bash
# CVE-2026-110355 Imperia CMS SiteActive SSTI Pre-Auth RCE Check
# Safe, non-exploitative detection only — no payload execution.
# Usage: bash check_cve_2026_110355.sh <base_url>
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

BASE_URL="${1:-}"
if [[ -z "$BASE_URL" ]]; then
  echo "Usage: $0 <base_url>  (e.g. https://target.example.de)"
  exit 2
fi

# Strip trailing slash
BASE_URL="${BASE_URL%/}"
ENDPOINT="${BASE_URL}/cgi-bin/site_active.pl"

echo "[*] CVE-2026-110355 — Imperia CMS SiteActive SSTI Check"
echo "[*] Target: ${BASE_URL}"
echo ""

# Step 1: Check if the SiteActive endpoint is reachable
echo "[*] Step 1: Probing SiteActive endpoint..."
HTTP_CODE=$(curl -sk -o /dev/null -w '%{http_code}' --max-time 10 "${ENDPOINT}" 2>/dev/null || echo "000")

if [[ "$HTTP_CODE" == "000" ]]; then
  echo "[-] Connection failed or timed out."
  echo "UNKNOWN — cannot reach ${ENDPOINT}"
  exit 2
elif [[ "$HTTP_CODE" == "403" || "$HTTP_CODE" == "404" || "$HTTP_CODE" == "405" ]]; then
  echo "[+] Endpoint returned HTTP ${HTTP_CODE} — SiteActive appears blocked or absent."
  echo "PATCHED — SiteActive endpoint not accessible (HTTP ${HTTP_CODE})"
  exit 1
elif [[ "$HTTP_CODE" =~ ^(200|302|301|500)$ ]]; then
  echo "[!] Endpoint returned HTTP ${HTTP_CODE} — SiteActive is reachable."
else
  echo "[?] Unexpected HTTP ${HTTP_CODE} from endpoint."
  echo "UNKNOWN — unexpected response"
  exit 2
fi

# Step 2: Check for Imperia CMS fingerprints in the response
echo "[*] Step 2: Checking for Imperia CMS fingerprints..."
RESPONSE=$(curl -sk --max-time 10 -D - "${ENDPOINT}" 2>/dev/null || true)

IS_IMPERIA=0
if echo "$RESPONSE" | grep -qi 'imperia'; then
  IS_IMPERIA=1
  echo "[!] Imperia CMS fingerprint detected in response."
elif echo "$RESPONSE" | grep -qi 'site.active\|siteactive\|SITE_ACTIVE'; then
  IS_IMPERIA=1
  echo "[!] SiteActive module fingerprint detected."
else
  echo "[?] No clear Imperia CMS fingerprint — endpoint may not be Imperia."
fi

# Step 3: Check with a safe TEMPLATE parameter (no exploit)
echo "[*] Step 3: Testing TEMPLATE parameter handling (safe probe)..."
SAFE_RESP=$(curl -sk -o /dev/null -w '%{http_code}' --max-time 10 \
  "${ENDPOINT}?TEMPLATE={SITE_ACTIVE}noisgate_safe_probe_test" 2>/dev/null || echo "000")

if [[ "$SAFE_RESP" == "200" || "$SAFE_RESP" == "500" ]]; then
  echo "[!] TEMPLATE parameter with {SITE_ACTIVE} prefix accepted (HTTP ${SAFE_RESP})."
  echo "[!] The SiteActive endpoint processes TEMPLATE parameters — exploitation likely possible."
  echo ""
  echo "VULNERABLE — Imperia CMS SiteActive endpoint is reachable and processes TEMPLATE parameter."
  echo "  Affected: Imperia CMS <= 11.7.2"
  echo "  Fix: Upgrade to 11.8.0+ or block /cgi-bin/site_active.pl"
  exit 0
elif [[ "$SAFE_RESP" == "403" ]]; then
  echo "[+] TEMPLATE parameter request blocked (HTTP 403)."
  echo "PATCHED — TEMPLATE parameter requests are denied."
  exit 1
else
  if [[ $IS_IMPERIA -eq 1 ]]; then
    echo "[?] TEMPLATE probe returned HTTP ${SAFE_RESP} on confirmed Imperia instance."
    echo "UNKNOWN — Imperia detected but TEMPLATE handling unclear. Manual review recommended."
    exit 2
  else
    echo "[?] TEMPLATE probe returned HTTP ${SAFE_RESP} — may not be Imperia CMS."
    echo "UNKNOWN — could not confirm Imperia CMS or vulnerability status."
    exit 2
  fi
fi