New API SQL LIKE Wildcard Injection DoS via Token Search

#!/usr/bin/env bash
# check_cve_2026_25591.sh — Detect CVE-2026-25591 (SQL LIKE Wildcard Injection DoS)
# Usage: bash check_cve_2026_25591.sh <NEW_API_BASE_URL>
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

BASE_URL="${1:-}"
if [ -z "$BASE_URL" ]; then
  echo "Usage: $0 <NEW_API_BASE_URL>"
  echo "Example: $0 https://ai-gateway.internal:3000"
  exit 2
fi

# Strip trailing slash
BASE_URL="${BASE_URL%/}"

# Try to get version from /api/status
RESPONSE=$(curl -sf --max-time 10 "${BASE_URL}/api/status" 2>/dev/null || true)

if [ -z "$RESPONSE" ]; then
  echo "UNKNOWN — could not reach ${BASE_URL}/api/status"
  echo "Verify the URL and that the New API instance is running."
  exit 2
fi

# Extract version string (e.g., "0.10.8-alpha.10")
VERSION=$(echo "$RESPONSE" | jq -r '.data.version // .version // empty' 2>/dev/null || true)

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — /api/status responded but version field not found."
  echo "Response: $RESPONSE"
  echo "Manual check: verify version >= 0.10.8-alpha.10 in your deployment config."
  exit 2
fi

echo "Detected New API version: $VERSION"

# Parse version components
# Fixed version is 0.10.8-alpha.10
# We need to compare: major.minor.patch-prerelease
FIXED_MAJOR=0
FIXED_MINOR=10
FIXED_PATCH=8
FIXED_PRE=10

# Extract major.minor.patch
MAJOR=$(echo "$VERSION" | grep -oP '^\d+' || echo "0")
MINOR=$(echo "$VERSION" | grep -oP '^\d+\.\K\d+' || echo "0")
PATCH=$(echo "$VERSION" | grep -oP '^\d+\.\d+\.\K\d+' || echo "0")

# Extract alpha prerelease number if present
PRE=$(echo "$VERSION" | grep -oP 'alpha\.\K\d+' || echo "999")

# Compare versions
if [ "$MAJOR" -gt "$FIXED_MAJOR" ]; then
  echo "PATCHED — version $VERSION is newer than fixed version 0.10.8-alpha.10."
  exit 0
elif [ "$MAJOR" -eq "$FIXED_MAJOR" ] && [ "$MINOR" -gt "$FIXED_MINOR" ]; then
  echo "PATCHED — version $VERSION is newer than fixed version 0.10.8-alpha.10."
  exit 0
elif [ "$MAJOR" -eq "$FIXED_MAJOR" ] && [ "$MINOR" -eq "$FIXED_MINOR" ] && [ "$PATCH" -gt "$FIXED_PATCH" ]; then
  echo "PATCHED — version $VERSION is newer than fixed version 0.10.8-alpha.10."
  exit 0
elif [ "$MAJOR" -eq "$FIXED_MAJOR" ] && [ "$MINOR" -eq "$FIXED_MINOR" ] && [ "$PATCH" -eq "$FIXED_PATCH" ]; then
  # Same base version — check prerelease
  if echo "$VERSION" | grep -qP 'alpha'; then
    if [ "$PRE" -ge "$FIXED_PRE" ]; then
      echo "PATCHED — version $VERSION includes the fix for CVE-2026-25591."
      exit 0
    else
      echo "VULNERABLE — version $VERSION is below the fixed version 0.10.8-alpha.10."
      echo "Upgrade to 0.10.8-alpha.10 or later."
      exit 1
    fi
  else
    # 0.10.8 release (no alpha) is newer than 0.10.8-alpha.10
    echo "PATCHED — version $VERSION is a release newer than 0.10.8-alpha.10."
    exit 0
  fi
else
  echo "VULNERABLE — version $VERSION is below the fixed version 0.10.8-alpha.10."
  echo "Upgrade to 0.10.8-alpha.10 or later."
  exit 1
fi