Citrix NetScaler ADC and Gateway SAML HTTP-Redirect Binding Authentication Bypass

#!/usr/bin/env bash
# check_cve_2026_19490.sh — CVE-2026-19490 NetScaler SAML auth bypass detector
# Safe check: version fingerprint + SAML endpoint probe (no exploitation)
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

TARGET="${1:?Usage: $0 <target_hostname_or_ip>}"
BASE="https://${TARGET}"
RESULT="UNKNOWN"

echo "[*] CVE-2026-19490 checker for NetScaler ADC/Gateway"
echo "[*] Target: ${TARGET}"
echo ""

# Step 1: Grab version from login page JavaScript
echo "[*] Step 1: Attempting version fingerprint..."
VER_RAW=$(curl -sk --max-time 10 "${BASE}/vpn/index.html" 2>/dev/null || true)

if [ -z "$VER_RAW" ]; then
  echo "[-] Could not reach ${BASE}/vpn/index.html"
  echo "UNKNOWN — target unreachable or not a NetScaler"
  exit 2
fi

# Try to extract build string
BUILD=$(echo "$VER_RAW" | grep -oP '(13\.1|14\.1)-[0-9]+\.[0-9]+' | head -1 || true)

if [ -n "$BUILD" ]; then
  echo "[+] Detected build: ${BUILD}"
  MAJOR=$(echo "$BUILD" | cut -d'-' -f1)
  MINOR=$(echo "$BUILD" | cut -d'-' -f2 | cut -d'.' -f1)
  PATCH=$(echo "$BUILD" | cut -d'.' -f2)

  if [ "$MAJOR" = "14.1" ]; then
    # Fixed at 14.1-73.32
    if [ "$MINOR" -gt 73 ] || ([ "$MINOR" -eq 73 ] && [ "$PATCH" -ge 32 ]); then
      echo "[+] Build ${BUILD} >= 14.1-73.32 — PATCHED"
      RESULT="PATCHED"
    else
      echo "[!] Build ${BUILD} < 14.1-73.32 — VULNERABLE"
      RESULT="VULNERABLE"
    fi
  elif [ "$MAJOR" = "13.1" ]; then
    # Fixed at 13.1-63.21
    if [ "$MINOR" -gt 63 ] || ([ "$MINOR" -eq 63 ] && [ "$PATCH" -ge 21 ]); then
      echo "[+] Build ${BUILD} >= 13.1-63.21 — PATCHED"
      RESULT="PATCHED"
    else
      echo "[!] Build ${BUILD} < 13.1-63.21 — VULNERABLE"
      RESULT="VULNERABLE"
    fi
  else
    echo "[?] Unrecognized major version: ${MAJOR}"
    RESULT="UNKNOWN"
  fi
else
  echo "[-] Could not extract build string from login page."
fi

# Step 2: Probe SAML redirect endpoint
echo ""
echo "[*] Step 2: Probing SAML redirect-binding endpoint..."
SAML_RESP=$(curl -sk --max-time 10 -o /dev/null -w "%{http_code}" "${BASE}/cgi/samlauth" 2>/dev/null || echo "000")
echo "[*] /cgi/samlauth returned HTTP ${SAML_RESP}"

if [ "$SAML_RESP" = "200" ] || [ "$SAML_RESP" = "302" ] || [ "$SAML_RESP" = "400" ]; then
  echo "[!] SAML endpoint is active — exploitable path exists"
  if [ "$RESULT" = "VULNERABLE" ]; then
    echo "[!!!] CONFIRMED: Version vulnerable AND SAML endpoint reachable"
  fi
elif [ "$SAML_RESP" = "403" ] || [ "$SAML_RESP" = "404" ]; then
  echo "[+] SAML endpoint not active (HTTP ${SAML_RESP}) — exploit path may not be reachable"
  if [ "$RESULT" = "VULNERABLE" ]; then
    echo "[*] Version is vulnerable but SAML endpoint not exposed — check SAML config"
  fi
else
  echo "[?] Unexpected response from SAML endpoint"
fi

echo ""
echo "========================================"
echo "RESULT: ${RESULT}"
echo "========================================"

case "$RESULT" in
  VULNERABLE) exit 0 ;;
  PATCHED)    exit 1 ;;
  *)          exit 2 ;;
esac