Sensitive information disclosure and manipulation due to improper authentication

#!/usr/bin/env python3
# check_acronis_cve_2026_28710.py
# Detect likely vulnerability status for CVE-2026-28710 on Acronis Cyber Protect 17
# Affected: builds before 41186 on Linux/Windows
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import re
import sys
import glob
import platform
import subprocess

THRESHOLD = 41186


def parse_build(text):
    if not text:
        return None
    # Prefer explicit build markers first
    patterns = [
        r'build\s*[:=]?\s*(\d{4,6})',
        r'17\.0\.(\d{4,6})',
        r'Acronis.*?(\d{4,6})'
    ]
    for pat in patterns:
        m = re.search(pat, text, re.IGNORECASE | re.DOTALL)
        if m:
            try:
                return int(m.group(1))
            except Exception:
                pass
    return None


def read_text_file(path):
    try:
        with open(path, 'r', encoding='utf-8', errors='ignore') as f:
            return f.read()
    except Exception:
        return None


def check_linux():
    candidates = [
        '/usr/lib/Acronis/**',
        '/opt/Acronis/**',
        '/var/lib/Acronis/**',
        '/etc/Acronis/**'
    ]
    seen = []
    for pattern in candidates:
        for path in glob.glob(pattern, recursive=True):
            if os.path.isfile(path):
                low = path.lower()
                if any(k in low for k in ['version', 'release', 'build', 'manifest']):
                    seen.append(path)
    for path in seen[:200]:
        txt = read_text_file(path)
        build = parse_build(txt)
        if build:
            return build, path

    # Fallback: try package managers
    commands = [
        ['rpm', '-qa'],
        ['dpkg-query', '-W', '-f=${Package} ${Version}\n']
    ]
    for cmd in commands:
        try:
            out = subprocess.check_output(cmd, stderr=subprocess.DEVNULL, text=True, timeout=20)
            if 'acronis' in out.lower():
                build = parse_build(out)
                if build:
                    return build, 'package-manager'
        except Exception:
            pass
    return None, None


def check_windows_registry():
    try:
        import winreg
    except Exception:
        return None, None

    keys = [
        r'SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall',
        r'SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall',
        r'SOFTWARE\Acronis'
    ]

    for hive in (winreg.HKEY_LOCAL_MACHINE,):
        for key_path in keys:
            try:
                base = winreg.OpenKey(hive, key_path)
            except Exception:
                continue
            try:
                count = winreg.QueryInfoKey(base)[0]
            except Exception:
                count = 0
            for i in range(count):
                try:
                    subname = winreg.EnumKey(base, i)
                    sub = winreg.OpenKey(base, subname)
                    values = {}
                    idx = 0
                    while True:
                        try:
                            name, value, _ = winreg.EnumValue(sub, idx)
                            values[name] = str(value)
                            idx += 1
                        except OSError:
                            break
                    blob = ' '.join(values.values())
                    if 'acronis' in blob.lower() and 'cyber protect' in blob.lower():
                        build = parse_build(blob)
                        if build:
                            return build, 'registry:' + key_path + '\\' + subname
                except Exception:
                    continue
    return None, None


def check_windows_files():
    roots = [
        os.environ.get('ProgramFiles', r'C:\Program Files'),
        os.environ.get('ProgramFiles(x86)', r'C:\Program Files (x86)'),
        os.environ.get('ProgramData', r'C:\ProgramData')
    ]
    seen = []
    for root in roots:
        if not root or not os.path.isdir(root):
            continue
        for pattern in [
            os.path.join(root, 'Acronis', '**', '*version*'),
            os.path.join(root, 'Acronis', '**', '*release*'),
            os.path.join(root, 'Acronis', '**', '*build*'),
            os.path.join(root, 'Acronis', '**', '*manifest*')
        ]:
            seen.extend(glob.glob(pattern, recursive=True))
    for path in seen[:300]:
        if os.path.isfile(path):
            txt = read_text_file(path)
            build = parse_build(txt)
            if build:
                return build, path
    return None, None


def main():
    system = platform.system().lower()
    build = None
    source = None

    if system == 'windows':
        build, source = check_windows_registry()
        if not build:
            build, source = check_windows_files()
    else:
        build, source = check_linux()

    if build is None:
        print('UNKNOWN - Acronis Cyber Protect 17 build not found automatically')
        sys.exit(2)

    if build < THRESHOLD:
        print(f'VULNERABLE - detected build {build} from {source}; fixed in build {THRESHOLD} or later')
        sys.exit(1)
    else:
        print(f'PATCHED - detected build {build} from {source}; meets/exceeds fixed build {THRESHOLD}')
        sys.exit(0)


if __name__ == '__main__':
    main()