Cisco Catalyst SD-WAN Manager Path Traversal Arbitrary File Write to Root

#!/usr/bin/env bash
# CVE-2026-20262 Checker — Cisco Catalyst SD-WAN Manager
# Checks installed version and scans for exploitation IOCs.
# Run on the vManage appliance as root/admin.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -uo pipefail

RESULT="UNKNOWN"
IOC_FOUND=0

# --- Determine installed version ---
VERSION=""
if [ -f /usr/share/viptela/version ]; then
    VERSION=$(head -1 /usr/share/viptela/version | tr -d '[:space:]')
elif [ -f /etc/viptela/version ]; then
    VERSION=$(head -1 /etc/viptela/version | tr -d '[:space:]')
else
    # Fallback: parse 'show software' output if available
    VERSION=$(vmanage 2>/dev/null <<< 'show software' | awk '/true/{print $1; exit}')
fi

if [ -z "$VERSION" ]; then
    echo "[!] Could not determine SD-WAN Manager version."
    echo "    Run 'show software' from the vManage CLI and compare manually."
    echo "STATUS: UNKNOWN"
    exit 2
fi

echo "[*] Detected version: $VERSION"

# --- Version comparison (sort -V based) ---
ver_gte() { [ "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" = "$2" ]; }

# --- Check against fixed releases ---
case "$VERSION" in
    20.9.*)
        ver_gte "$VERSION" "20.9.9.2" && RESULT="PATCHED" || RESULT="VULNERABLE" ;;
    20.12.*)
        ver_gte "$VERSION" "20.12.7.2" && RESULT="PATCHED" || RESULT="VULNERABLE" ;;
    20.15.4.*)
        ver_gte "$VERSION" "20.15.4.5" && RESULT="PATCHED" || RESULT="VULNERABLE" ;;
    20.15.5.*)
        ver_gte "$VERSION" "20.15.5.3" && RESULT="PATCHED" || RESULT="VULNERABLE" ;;
    20.15.*)
        RESULT="VULNERABLE" ;;
    20.18.*)
        ver_gte "$VERSION" "20.18.3.1" && RESULT="PATCHED" || RESULT="VULNERABLE" ;;
    26.*)
        ver_gte "$VERSION" "26.1.1.2" && RESULT="PATCHED" || RESULT="VULNERABLE" ;;
    *)
        echo "[!] Version $VERSION not in a known affected release train."
        RESULT="UNKNOWN" ;;
esac

# --- IOC scan in logs ---
LOG_DIR="/var/log/nms"
echo ""
echo "[*] Scanning logs for exploitation IOCs..."
if [ -d "$LOG_DIR" ]; then
    # Path-traversal patterns in upload requests
    if grep -rlE '\.\.(/|%2[fF]){2,}.*\.(war|jsp|sh)' "$LOG_DIR"/vmanage-server*.log 2>/dev/null; then
        echo "[!] WARNING: Path-traversal upload IOC detected!"
        IOC_FOUND=1
    fi
    # Unexpected WAR deployments
    if ls /var/lib/wildfly/standalone/deployments/*.war 2>/dev/null | grep -qvE '(vmanage|nms|portal)'; then
        echo "[!] WARNING: Unexpected WAR file in WildFly deployments!"
        ls /var/lib/wildfly/standalone/deployments/*.war 2>/dev/null
        IOC_FOUND=1
    fi
    if [ "$IOC_FOUND" -eq 0 ]; then
        echo "[*] No IOC patterns found in available logs."
    fi
else
    echo "[!] Log directory $LOG_DIR not found — skipping IOC check."
fi

echo ""
if [ "$IOC_FOUND" -eq 1 ]; then
    echo "[!!!] EXPLOITATION IOCs DETECTED — initiate incident response."
fi
echo "STATUS: $RESULT"

case "$RESULT" in
    VULNERABLE) exit 1 ;;
    PATCHED)    exit 0 ;;
    *)          exit 2 ;;
esac