Oracle PeopleSoft PeopleTools PSEMHUB Unauthenticated Java Deserialization RCE

#!/usr/bin/env bash
# check_cve_2026_35273.sh — Detect CVE-2026-35273 (Oracle PeopleSoft PSEMHUB RCE)
# Usage: bash check_cve_2026_35273.sh <BASE_URL>
# Exit codes: 0 = VULNERABLE, 1 = PATCHED, 2 = UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <BASE_URL>"
  echo "Example: $0 https://peoplesoft.example.com"
  exit 2
fi

BASE_URL="${1%/}"

echo "[*] Checking CVE-2026-35273 against: $BASE_URL"
echo "[*] Testing PSEMHUB endpoint reachability..."

# Test 1: Check if /PSEMHUB/hub endpoint is reachable (returns HTTP 200)
HTTP_CODE_HUB=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 10 "${BASE_URL}/PSEMHUB/hub" 2>/dev/null || echo "000")
echo "[*] /PSEMHUB/hub returned HTTP $HTTP_CODE_HUB"

# Test 2: Check URL-encoded variant (WAF bypass path)
HTTP_CODE_BYPASS=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 10 "${BASE_URL}/%50SEMHUB/hub" 2>/dev/null || echo "000")
echo "[*] /%50SEMHUB/hub (WAF bypass) returned HTTP $HTTP_CODE_BYPASS"

# Test 3: Check /PSIGW/HttpListeningConnector
HTTP_CODE_PSIGW=$(curl -sk -o /dev/null -w "%{http_code}" --max-time 10 "${BASE_URL}/PSIGW/HttpListeningConnector" 2>/dev/null || echo "000")
echo "[*] /PSIGW/HttpListeningConnector returned HTTP $HTTP_CODE_PSIGW"

# Test 4: Check PeopleTools version from sign-in page (if visible)
VERSION_INFO=$(curl -sk --max-time 10 "${BASE_URL}/psp/ps/?cmd=login" 2>/dev/null | grep -oP 'PeopleTools\s+\K[0-9]+\.[0-9]+\.[0-9]+' || echo "unknown")
echo "[*] Detected PeopleTools version: $VERSION_INFO"

# Evaluation logic
if [ "$HTTP_CODE_HUB" = "000" ] && [ "$HTTP_CODE_BYPASS" = "000" ]; then
  echo ""
  echo "UNKNOWN — Could not connect to $BASE_URL. Verify the URL and network connectivity."
  exit 2
fi

VULN=0

# PSEMHUB endpoint accessible = vulnerable (unless patched version detected)
if [ "$HTTP_CODE_HUB" = "200" ] || [ "$HTTP_CODE_BYPASS" = "200" ]; then
  VULN=1
  echo "[!] PSEMHUB endpoint is accessible from the network."
fi

if [ "$HTTP_CODE_BYPASS" = "200" ] && [ "$HTTP_CODE_HUB" != "200" ]; then
  echo "[!] WARNING: WAF bypass path (/%50SEMHUB/) reaches the endpoint even though /PSEMHUB/ is blocked."
  echo "[!] Your WAF is NOT performing URL-decoded path matching."
fi

# Version check
if [ "$VERSION_INFO" != "unknown" ]; then
  MAJOR=$(echo "$VERSION_INFO" | cut -d. -f1-2)
  PATCH=$(echo "$VERSION_INFO" | cut -d. -f3)
  if [ "$MAJOR" = "8.61" ] && [ "$PATCH" -lt 8 ] 2>/dev/null; then
    VULN=1
    echo "[!] PeopleTools $VERSION_INFO is below patched version 8.61.08."
  elif [ "$MAJOR" = "8.62" ] && [ "$PATCH" -lt 2 ] 2>/dev/null; then
    VULN=1
    echo "[!] PeopleTools $VERSION_INFO is below patched version 8.62.02."
  elif [ "$MAJOR" = "8.61" ] && [ "$PATCH" -ge 8 ] 2>/dev/null; then
    echo "[+] PeopleTools $VERSION_INFO appears patched (>= 8.61.08)."
    if [ "$HTTP_CODE_HUB" = "200" ] || [ "$HTTP_CODE_BYPASS" = "200" ]; then
      echo "[!] WARNING: Patched version detected but PSEMHUB endpoint is still accessible."
      echo "[!] Verify patch was fully applied and PIA domain was redeployed."
      VULN=1
    fi
  elif [ "$MAJOR" = "8.62" ] && [ "$PATCH" -ge 2 ] 2>/dev/null; then
    echo "[+] PeopleTools $VERSION_INFO appears patched (>= 8.62.02)."
    if [ "$HTTP_CODE_HUB" = "200" ] || [ "$HTTP_CODE_BYPASS" = "200" ]; then
      echo "[!] WARNING: Patched version detected but PSEMHUB endpoint is still accessible."
      echo "[!] Verify patch was fully applied and WebLogic binaries were updated."
      VULN=1
    fi
  fi
fi

echo ""
if [ $VULN -eq 1 ]; then
  echo "VULNERABLE — CVE-2026-35273: PSEMHUB endpoint is reachable and/or PeopleTools version is unpatched."
  echo "ACTION: Remove PSEMHUB from WebLogic deployments immediately. Apply Oracle patch 8.61.08+ / 8.62.02+."
  exit 0
elif [ "$HTTP_CODE_HUB" = "403" ] || [ "$HTTP_CODE_HUB" = "404" ] || [ "$HTTP_CODE_HUB" = "401" ]; then
  if [ "$HTTP_CODE_BYPASS" = "403" ] || [ "$HTTP_CODE_BYPASS" = "404" ] || [ "$HTTP_CODE_BYPASS" = "401" ] || [ "$HTTP_CODE_BYPASS" = "000" ]; then
    echo "PATCHED — PSEMHUB endpoint is not accessible (HTTP $HTTP_CODE_HUB). Mitigation or patch appears applied."
    exit 1
  fi
fi

echo "UNKNOWN — Could not conclusively determine vulnerability status. Manual verification required."
echo "Check: (1) PeopleTools version via PIA admin, (2) PSEMHUB deployment status in WebLogic console."
exit 2