Mozilla Firefox/Thunderbird OneCRL blocklist delivery gap for compromised eMudhra intermediate CAs

#!/usr/bin/env bash
# CVE-2026-113470 — Firefox/Thunderbird eMudhra OneCRL blocklist gap check
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -uo pipefail

RESULT="UNKNOWN"
FF_BIN=""
PRODUCT=""

# Locate Firefox or Thunderbird
for candidate in firefox firefox-esr thunderbird; do
    if command -v "$candidate" &>/dev/null; then
        FF_BIN="$candidate"
        case "$candidate" in
            thunderbird)  PRODUCT="Thunderbird" ;;
            firefox-esr)  PRODUCT="Firefox ESR" ;;
            *)            PRODUCT="Firefox" ;;
        esac
        break
    fi
done

if [[ -z "$FF_BIN" ]]; then
    echo "UNKNOWN - Neither Firefox nor Thunderbird found in PATH"
    exit 2
fi

# Extract version string
VERSION_LINE=$($FF_BIN --version 2>/dev/null || true)
FF_VERSION=$(echo "$VERSION_LINE" | grep -oP '[0-9]+\.[0-9]+\.?[0-9]*' | head -1)

if [[ -z "$FF_VERSION" ]]; then
    echo "UNKNOWN - Could not parse version from: $VERSION_LINE"
    exit 2
fi

echo "[*] Detected: $PRODUCT $FF_VERSION ($FF_BIN)"

# Version comparison: returns 0 if $1 >= $2
version_ge() {
    [[ "$(printf '%s\n%s' "$1" "$2" | sort -V | head -1)" == "$2" ]]
}

# Determine ESR status
IS_ESR=false
[[ "$FF_BIN" == *"esr"* ]] && IS_ESR=true
$FF_BIN --version 2>/dev/null | grep -qi "esr" && IS_ESR=true

MAJOR=$(echo "$FF_VERSION" | cut -d. -f1)

# Check against fixed versions
if [[ "$PRODUCT" == "Thunderbird" ]]; then
    if [[ "$MAJOR" -ge 158 ]] && version_ge "$FF_VERSION" "158.0.1"; then
        RESULT="PATCHED"
    elif [[ "$MAJOR" -eq 153 ]] && version_ge "$FF_VERSION" "153.5.1"; then
        RESULT="PATCHED"
    else
        RESULT="VULNERABLE"
    fi
elif $IS_ESR; then
    if [[ "$MAJOR" -eq 115 ]]; then
        version_ge "$FF_VERSION" "115.43.1" && RESULT="PATCHED" || RESULT="VULNERABLE"
    elif [[ "$MAJOR" -eq 153 ]]; then
        version_ge "$FF_VERSION" "153.5.1" && RESULT="PATCHED" || RESULT="VULNERABLE"
    elif [[ "$MAJOR" -ge 158 ]]; then
        RESULT="PATCHED"
    else
        RESULT="VULNERABLE"
    fi
else
    version_ge "$FF_VERSION" "158.0.1" && RESULT="PATCHED" || RESULT="VULNERABLE"
fi

# Check if RemoteSettings is disabled by enterprise policy
RS_DISABLED=false
POLICY_DIRS=(
    "/etc/firefox/policies"
    "/usr/lib/firefox/distribution"
    "/usr/lib64/firefox/distribution"
    "/snap/firefox/current/distribution"
    "/etc/thunderbird/policies"
    "/usr/lib/thunderbird/distribution"
)
for dir in "${POLICY_DIRS[@]}"; do
    pf="$dir/policies.json"
    if [[ -f "$pf" ]] && grep -qi 'DisableRemoteSettingsAndAcceptSecurityConsequences' "$pf" 2>/dev/null; then
        RS_DISABLED=true
        echo "[!] WARNING: RemoteSettings disabled by policy in $pf"
        break
    fi
done

# Final output
if [[ "$RESULT" == "PATCHED" ]]; then
    echo "PATCHED - $PRODUCT $FF_VERSION includes baked-in eMudhra OneCRL blocklist (CVE-2026-113470)"
    exit 0
elif [[ "$RESULT" == "VULNERABLE" ]]; then
    if $RS_DISABLED; then
        echo "VULNERABLE - $PRODUCT $FF_VERSION unpatched AND RemoteSettings disabled — FULLY EXPOSED to CVE-2026-113470"
    else
        echo "VULNERABLE - $PRODUCT $FF_VERSION binary unpatched, but RemoteSettings likely delivered OneCRL on Oct 17 (reduced risk unless RS is blocked by network)"
    fi
    exit 1
else
    echo "UNKNOWN - Could not determine status for $PRODUCT $FF_VERSION"
    exit 2
fi