Cisco Unified Communications Manager WebDialer SSRF to Root Privilege Escalation

#!/bin/bash
# CVE-2026-20230 Checker for Cisco Unified Communications Manager
# Checks WebDialer service status and installed version against fixed releases.
# Run on CUCM publisher/subscriber via admin CLI (SSH).
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

RESULT="UNKNOWN"
WEBDIALER_ACTIVE="unknown"
VERSION="unknown"

# --- Check WebDialer service status ---
if command -v utils 2>/dev/null | grep -q utils; then
  # CUCM CLI environment
  WD_STATUS=$(echo 'utils service list' | sudo -u admin cli 2>/dev/null | grep -i 'webdialer' || true)
else
  # Direct OS check for Tomcat-based WebDialer
  WD_STATUS=$(ps aux 2>/dev/null | grep -i '[w]ebdialer' || true)
  if [ -z "$WD_STATUS" ]; then
    WD_STATUS=$(systemctl is-active cisco-webdialer 2>/dev/null || true)
  fi
fi

if echo "$WD_STATUS" | grep -iqE '(started|running|active)'; then
  WEBDIALER_ACTIVE="yes"
elif echo "$WD_STATUS" | grep -iqE '(stopped|inactive|deactivated|not)'; then
  WEBDIALER_ACTIVE="no"
fi

# --- Check installed version ---
if [ -f /usr/local/cm/version.txt ]; then
  VERSION=$(cat /usr/local/cm/version.txt 2>/dev/null | head -1)
elif [ -f /usr/local/platform/.version ]; then
  VERSION=$(cat /usr/local/platform/.version 2>/dev/null | head -1)
elif command -v show 2>/dev/null | grep -q show; then
  VERSION=$(echo 'show version active' | sudo -u admin cli 2>/dev/null | grep -i 'active' | head -1 || true)
fi

# --- Version comparison ---
# Fixed: 14SU6+ or 15SU5+
VULN_BY_VERSION="unknown"
if echo "$VERSION" | grep -qE '^14\.'; then
  SU_NUM=$(echo "$VERSION" | grep -oP 'SU\K[0-9]+' || echo "0")
  if [ "$SU_NUM" -ge 6 ] 2>/dev/null; then
    VULN_BY_VERSION="no"
  else
    VULN_BY_VERSION="yes"
  fi
elif echo "$VERSION" | grep -qE '^15\.'; then
  SU_NUM=$(echo "$VERSION" | grep -oP 'SU\K[0-9]+' || echo "0")
  if [ "$SU_NUM" -ge 5 ] 2>/dev/null; then
    VULN_BY_VERSION="no"
  else
    VULN_BY_VERSION="yes"
  fi
elif echo "$VERSION" | grep -qE '^(11|12|10)\.'; then
  VULN_BY_VERSION="yes"  # EoS releases, no patch available
fi

# --- Check for webshell IOCs ---
IOC_FOUND="no"
if find /opt/cisco/ /usr/local/thirdparty/jakarta-tomcat/webapps/ -name '*.jsp' -newer /usr/local/cm/version.txt 2>/dev/null | grep -qE '(axis2-web|cmd|shell|upload)'; then
  IOC_FOUND="yes"
fi
if [ -f /tmp/cve-2026-20230-test.txt ]; then
  IOC_FOUND="yes"
fi

# --- Determine result ---
echo "=== CVE-2026-20230 Assessment ==="
echo "CUCM Version:     $VERSION"
echo "WebDialer Active: $WEBDIALER_ACTIVE"
echo "Vulnerable (ver): $VULN_BY_VERSION"
echo "IOC artifacts:    $IOC_FOUND"
echo ""

if [ "$IOC_FOUND" = "yes" ]; then
  echo "!! COMPROMISE INDICATORS DETECTED — investigate immediately !!"
  RESULT="VULNERABLE"
elif [ "$VULN_BY_VERSION" = "no" ]; then
  RESULT="PATCHED"
elif [ "$VULN_BY_VERSION" = "yes" ] && [ "$WEBDIALER_ACTIVE" = "yes" ]; then
  RESULT="VULNERABLE"
  echo "** WebDialer is ACTIVE on a vulnerable version — actively exploitable **"
elif [ "$VULN_BY_VERSION" = "yes" ] && [ "$WEBDIALER_ACTIVE" = "no" ]; then
  RESULT="VULNERABLE"
  echo "** Version is vulnerable but WebDialer is inactive — not currently exploitable **"
  echo "** Patch anyway: WebDialer could be re-enabled **"
else
  RESULT="UNKNOWN"
fi

echo ""
echo "$RESULT"

case $RESULT in
  PATCHED)    exit 0 ;;
  VULNERABLE) exit 1 ;;
  *)          exit 2 ;;
esac