Ivanti Connect Secure dsinvoked untrusted DSCache privilege escalation to root

#!/bin/bash
# CVE-2026-111357 — Ivanti Connect Secure dsinvoked DSCache privilege escalation
# Checks whether the running ICS build is in the affected range.
# Run on the appliance. Exit 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN.
set -uo pipefail

VULN_BUILD=19097  # 22.8R2.4 Build 19097 — last confirmed vulnerable build
VERSION=""

# --- Attempt to read version from known file locations ---
for vfile in \
  /home/runtime/etc/build_info \
  /home/runtime/etc/appliance-branding/ivanti/version \
  /data/etc/build_info \
  /home/webserver/htdocs/dana-na/auth/welcome.cgi; do
  if [[ -r "$vfile" ]]; then
    VERSION=$(head -5 "$vfile" 2>/dev/null || true)
    if [[ -n "$VERSION" ]]; then
      break
    fi
  fi
done

# --- Try dsversion command ---
if [[ -z "$VERSION" ]] && command -v dsversion &>/dev/null; then
  VERSION=$(dsversion 2>/dev/null || true)
fi

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — Could not read ICS version. Check Admin UI > System > Overview."
  exit 2
fi

echo "[*] Detected version info: $VERSION"

# --- Check for 22.7 and below (not affected) ---
if echo "$VERSION" | grep -qiE '22\.[0-7]R[0-9]'; then
  echo "PATCHED — Version 22.7.x and below are not affected by CVE-2026-111357."
  exit 0
fi

# --- Check for vulnerable 22.8R2.0 through 22.8R2.4 ---
if echo "$VERSION" | grep -qiE '22\.8R2\.[0-4]([^0-9]|$)'; then
  echo "VULNERABLE — Version matches affected range (22.8R2.0–22.8R2.4)."
  echo "ACTION: Apply the CVE-2026-111357 patch released 2026-10-29 immediately."
  echo "        Also verify CVE-2026-104935 is patched (22.8R2.5+)."
  exit 1
fi

# --- Check build number if extractable ---
BUILD=""
if [[ "$VERSION" =~ [Bb]uild[[:space:]]*([0-9]+) ]]; then
  BUILD="${BASH_REMATCH[1]}"
elif [[ "$VERSION" =~ \.([0-9]{4,6})$ ]]; then
  BUILD="${BASH_REMATCH[1]}"
fi

if [[ -n "$BUILD" ]]; then
  if (( BUILD <= VULN_BUILD )); then
    echo "VULNERABLE — Build $BUILD <= $VULN_BUILD (22.8R2.4)."
    echo "ACTION: Apply the CVE-2026-111357 patch released 2026-10-29 immediately."
    exit 1
  else
    echo "PATCHED — Build $BUILD is above the last known vulnerable build ($VULN_BUILD)."
    exit 0
  fi
fi

# --- Check for 22.8R2.5+ or 25.x (likely patched) ---
if echo "$VERSION" | grep -qiE '22\.8R2\.[5-9]|22\.8R2\.[1-9][0-9]|25\.[0-9]'; then
  echo "PATCHED — Version appears to include the fix (22.8R2.5+ or 25.x)."
  echo "NOTE: Confirm against Ivanti advisory at hub.ivanti.com."
  exit 0
fi

echo "UNKNOWN — Could not conclusively determine status for: $VERSION"
echo "Verify at: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935"
exit 2