OpenSSH SplitSSHell — authorized_keys cert-authority principal matching bypass via comma parsing

#!/usr/bin/env bash
# CVE-2026-35414 Exposure Auditor — SplitSSHell
# Checks OpenSSH version + cert-authority config exposure
# Exit: 0=PATCHED  1=VULNERABLE  2=UNKNOWN
set -uo pipefail

RESULT="UNKNOWN"
FIXED_MAJOR=10
FIXED_MINOR=3
VERSION_STRING=""

# --- Step 1: Determine OpenSSH version ---
if command -v sshd >/dev/null 2>&1; then
    VERSION_STRING=$(sshd -V 2>&1 | grep -oP 'OpenSSH_\K[0-9]+\.[0-9p]+' || true)
fi
if [[ -z "$VERSION_STRING" ]] && command -v ssh >/dev/null 2>&1; then
    VERSION_STRING=$(ssh -V 2>&1 | grep -oP 'OpenSSH_\K[0-9]+\.[0-9p]+' || true)
fi
if [[ -z "$VERSION_STRING" ]]; then
    echo "UNKNOWN — could not determine OpenSSH version"
    exit 2
fi

MAJOR=$(echo "$VERSION_STRING" | cut -d. -f1)
MINOR=$(echo "$VERSION_STRING" | cut -d. -f2 | sed 's/p.*//')
echo "[*] OpenSSH version: $VERSION_STRING"

# --- Step 2: Version comparison ---
if [[ "$MAJOR" -gt "$FIXED_MAJOR" ]] || \
   { [[ "$MAJOR" -eq "$FIXED_MAJOR" ]] && [[ "$MINOR" -ge "$FIXED_MINOR" ]]; }; then
    echo "[+] Version >= 10.3 — not vulnerable"
    RESULT="PATCHED"
else
    # Check for distro backport patches
    BACKPORTED=false
    if command -v dpkg >/dev/null 2>&1; then
        PKG=$(dpkg -s openssh-server 2>/dev/null | grep '^Version:' | awk '{print $2}' || true)
        if [[ -n "$PKG" ]]; then
            echo "[*] Debian/Ubuntu package: $PKG"
            if zgrep -q 'CVE-2026-35414' /usr/share/doc/openssh-server/changelog.Debian.gz 2>/dev/null; then
                BACKPORTED=true
            fi
        fi
    fi
    if command -v rpm >/dev/null 2>&1 && [[ "$BACKPORTED" == false ]]; then
        PKG=$(rpm -q openssh-server 2>/dev/null || true)
        if [[ -n "$PKG" ]]; then
            echo "[*] RPM package: $PKG"
            if rpm -q --changelog openssh-server 2>/dev/null | head -200 | grep -q 'CVE-2026-35414'; then
                BACKPORTED=true
            fi
        fi
    fi
    if $BACKPORTED; then
        echo "[+] Distro backport patch for CVE-2026-35414 detected"
        RESULT="PATCHED"
    else
        RESULT="VULNERABLE"
        echo "[-] Version $VERSION_STRING < 10.3 — VULNERABLE"
    fi
fi

# --- Step 3: Configuration exposure (only if vulnerable) ---
if [[ "$RESULT" == "VULNERABLE" ]]; then
    echo ""
    echo "--- Configuration Exposure ---"
    CERT_AUTH_COUNT=0
    while IFS=: read -r _user _ _ _ _ home shell; do
        [[ "$shell" == */nologin || "$shell" == */false ]] && continue
        AK="$home/.ssh/authorized_keys"
        if [[ -r "$AK" ]] && grep -q 'cert-authority' "$AK" 2>/dev/null; then
            HITS=$(grep -c 'cert-authority' "$AK" 2>/dev/null || echo 0)
            PRINS=$(grep 'cert-authority' "$AK" | grep -c 'principals=' 2>/dev/null || echo 0)
            echo "  [!] $AK: $HITS cert-authority line(s), $PRINS with principals="
            CERT_AUTH_COUNT=$((CERT_AUTH_COUNT + HITS))
        fi
    done < /etc/passwd

    TRUSTED_CA=false
    if [[ -r /etc/ssh/sshd_config ]] && grep -qi '^[[:space:]]*TrustedUserCAKeys' /etc/ssh/sshd_config 2>/dev/null; then
        TRUSTED_CA=true
        echo "  [i] TrustedUserCAKeys configured in sshd_config (NOT affected by this CVE)"
    fi

    echo ""
    if [[ $CERT_AUTH_COUNT -gt 0 ]]; then
        echo "VULNERABLE — unpatched AND cert-authority in authorized_keys detected"
        echo "This host is DIRECTLY EXPOSED to CVE-2026-35414."
    else
        echo "VULNERABLE — unpatched, but no cert-authority usage found"
        echo "Exposure is LOW unless cert-authority is added. Patch recommended."
    fi
fi

echo ""
echo "$RESULT"
case "$RESULT" in
    PATCHED)    exit 0 ;;
    VULNERABLE) exit 1 ;;
    *)          exit 2 ;;
esac