Apache Traffic Server experimental magick plugin unauthenticated argument injection via unvalidated query strings

#!/usr/bin/env bash
# check_cve_2026_111813.sh — detect exposure to CVE-2026-111813
# Apache Traffic Server experimental magick plugin argument injection
# Output: VULNERABLE / PATCHED / UNKNOWN
set -euo pipefail

RESULT="UNKNOWN"

# --- Locate traffic_server binary ---
TS_BIN=$(command -v traffic_server 2>/dev/null || find /opt/ts /usr/local /usr -name traffic_server -type f 2>/dev/null | head -1)
if [[ -z "$TS_BIN" ]]; then
  echo "[!] traffic_server binary not found — ATS may not be installed."
  echo "UNKNOWN"
  exit 2
fi

# --- Get version ---
VERSION=$($TS_BIN --version 2>/dev/null | grep -oP '(?<=Traffic Server -- )[0-9]+\.[0-9]+\.[0-9]+' || echo "")
if [[ -z "$VERSION" ]]; then
  VERSION=$($TS_BIN -V 2>/dev/null | grep -oP '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || echo "")
fi
echo "[*] Detected ATS version: ${VERSION:-unknown}"

# --- Locate plugin.config ---
CONFDIR=$(traffic_layout info 2>/dev/null | grep -oP '(?<=SYSCONFDIR: ).*' || echo "")
if [[ -z "$CONFDIR" ]]; then
  for d in /etc/trafficserver /opt/ts/etc/trafficserver /usr/local/etc/trafficserver; do
    [[ -f "$d/plugin.config" ]] && CONFDIR="$d" && break
  done
fi
PLUGIN_CONF="${CONFDIR}/plugin.config"

if [[ ! -f "$PLUGIN_CONF" ]]; then
  echo "[!] plugin.config not found. Cannot determine if magick plugin is loaded."
  echo "UNKNOWN"
  exit 2
fi

# --- Check if magick plugin is loaded ---
MAGICK_LOADED=$(grep -E '^[^#]*magick\.so' "$PLUGIN_CONF" || true)
if [[ -z "$MAGICK_LOADED" ]]; then
  echo "[+] magick plugin is NOT loaded in plugin.config."
  echo "[+] This host is NOT affected by CVE-2026-111813."
  echo "PATCHED"
  exit 0
fi
echo "[!] magick plugin IS loaded: $MAGICK_LOADED"

# --- Version comparison ---
version_gte() {
  printf '%s\n%s' "$2" "$1" | sort -V -C
}

if [[ -n "$VERSION" ]]; then
  MAJOR=$(echo "$VERSION" | cut -d. -f1)
  case "$MAJOR" in
    8)
      if version_gte "$VERSION" "8.0.1" && ! version_gte "$VERSION" "8.2.0"; then
        echo "[!] ATS 8.x series (8.0.1-8.1.11) — no fix available for 8.x branch."
        RESULT="VULNERABLE"
      fi
      ;;
    9)
      if version_gte "$VERSION" "9.2.16"; then
        echo "[+] ATS $VERSION >= 9.2.16 — patched."
        RESULT="PATCHED"
      elif version_gte "$VERSION" "9.0.0"; then
        echo "[!] ATS $VERSION is in affected range 9.0.0-9.2.15."
        RESULT="VULNERABLE"
      fi
      ;;
    10)
      if version_gte "$VERSION" "10.2.1"; then
        echo "[+] ATS $VERSION >= 10.2.1 — patched."
        RESULT="PATCHED"
      elif version_gte "$VERSION" "10.1.5" && ! version_gte "$VERSION" "10.2.0"; then
        echo "[+] ATS $VERSION >= 10.1.5 (10.1.x branch) — patched."
        RESULT="PATCHED"
      elif version_gte "$VERSION" "10.0.0"; then
        echo "[!] ATS $VERSION is in affected range 10.0.0-10.1.4 or 10.2.0."
        RESULT="VULNERABLE"
      fi
      ;;
    *)
      echo "[?] Unexpected major version $MAJOR — cannot determine status."
      RESULT="UNKNOWN"
      ;;
  esac
else
  echo "[!] Could not determine ATS version."
  RESULT="UNKNOWN"
fi

if [[ "$RESULT" == "VULNERABLE" ]]; then
  echo ""
  echo "=== VULNERABLE ==="
  echo "The magick plugin is loaded AND the ATS version is in the affected range."
  echo "Immediate action: comment out magick.so in $PLUGIN_CONF and run: traffic_ctl config reload"
  exit 1
fi

echo "$RESULT"
[[ "$RESULT" == "PATCHED" ]] && exit 0
exit 2