Documenso Google OAuth Login 2FA Bypass via handle-oauth-callback-url.ts

#!/usr/bin/env bash
# CVE-2026-13543 - Documenso 2FA Bypass via Google OAuth
# Checks: (1) vulnerable version range, (2) Google OAuth enabled
# Usage: bash check_cve_2026_13543.sh <documenso_install_path>
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

INSTALL_PATH="${1:-}"

if [ -z "$INSTALL_PATH" ]; then
  echo "Usage: $0 <documenso_install_path>"
  echo "  e.g. $0 /opt/documenso"
  echo "  For Docker: $0 /app  (run inside container)"
  exit 2
fi

PKG_JSON="$INSTALL_PATH/package.json"
ENV_FILE="$INSTALL_PATH/.env"
DOCKER_COMPOSE="$INSTALL_PATH/docker-compose.yml"

# --- Version check ---
if [ ! -f "$PKG_JSON" ]; then
  echo "[UNKNOWN] Cannot find $PKG_JSON — verify path or run inside Docker container."
  exit 2
fi

VERSION=$(grep -oP '"version"\s*:\s*"\K[^"]+' "$PKG_JSON" 2>/dev/null || true)
if [ -z "$VERSION" ]; then
  echo "[UNKNOWN] Could not parse version from $PKG_JSON"
  exit 2
fi

echo "Documenso version detected: $VERSION"

# Compare version — vulnerable range is 2.0.0 through 2.11.0
# But fix was never merged, so ALL 2.x versions are likely vulnerable
MAJOR=$(echo "$VERSION" | cut -d. -f1)
if [ "$MAJOR" -lt 2 ]; then
  echo "[PATCHED] Version $VERSION is below the affected range (2.0.0+)."
  exit 1
fi

# Since fix was never merged, all 2.x versions are vulnerable
# Check if the vulnerable file still has the unfixed code
VULN_FILE="$INSTALL_PATH/packages/auth/server/lib/utils/handle-oauth-callback-url.ts"
if [ -f "$VULN_FILE" ]; then
  # Check if 2FA enforcement exists in the OAuth callback handler
  if grep -qE '(verify.*2fa|check.*totp|twoFactor|two_factor)' "$VULN_FILE" 2>/dev/null; then
    echo "[PATCHED] Found 2FA enforcement in OAuth callback handler."
    exit 1
  else
    echo "[INFO] OAuth callback handler exists but lacks 2FA enforcement."
  fi
fi

# --- Check if Google OAuth is configured ---
OAUTH_ENABLED="unknown"
if [ -f "$ENV_FILE" ]; then
  if grep -qE 'NEXT_PUBLIC_WEBAPP_AUTH_GOOGLE_CLIENT_ID=.+' "$ENV_FILE" 2>/dev/null; then
    OAUTH_ENABLED="yes"
  else
    OAUTH_ENABLED="no"
  fi
elif [ -f "$DOCKER_COMPOSE" ]; then
  if grep -qE 'NEXT_PUBLIC_WEBAPP_AUTH_GOOGLE_CLIENT_ID' "$DOCKER_COMPOSE" 2>/dev/null; then
    OAUTH_ENABLED="yes"
  else
    OAUTH_ENABLED="no"
  fi
fi

# Also check environment variables directly
if [ -n "${NEXT_PUBLIC_WEBAPP_AUTH_GOOGLE_CLIENT_ID:-}" ]; then
  OAUTH_ENABLED="yes"
fi

echo "Google OAuth configured: $OAUTH_ENABLED"

if [ "$OAUTH_ENABLED" = "no" ]; then
  echo "[PATCHED] Documenso $VERSION is in the vulnerable range, but Google OAuth is not configured. The vulnerable code path is unreachable."
  exit 1
elif [ "$OAUTH_ENABLED" = "yes" ]; then
  echo "[VULNERABLE] Documenso $VERSION with Google OAuth enabled is affected by CVE-2026-13543."
  echo "  Action: Disable Google OAuth or enforce MFA at the Google account level."
  exit 0
else
  echo "[VULNERABLE] Documenso $VERSION is in the affected range. Could not determine if Google OAuth is enabled — assume vulnerable."
  echo "  Action: Check if NEXT_PUBLIC_WEBAPP_AUTH_GOOGLE_CLIENT_ID is set. If so, disable it or enforce MFA at Google."
  exit 0
fi