OpenSSH before 10

#!/usr/bin/env bash
# check-cve-2026-35414.sh
# Best-effort detector for CVE-2026-35414 on Linux/OpenSSH hosts.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

status="UNKNOWN"
reason=""
version_src=""
version_val=""
fixed_by_pkg=0
vuln_by_version=0
risky_cfg=0

have_cmd() { command -v "$1" >/dev/null 2>&1; }

log() { printf '%s\n' "$*"; }

# Try package-manager-aware fixed-version checks first for common Debian/Ubuntu cases.
check_dpkg_fixed() {
  have_cmd dpkg-query || return 1
  local pkgver=""
  pkgver=$(dpkg-query -W -f='${Version}\n' openssh-server 2>/dev/null || true)
  if [ -z "$pkgver" ]; then
    pkgver=$(dpkg-query -W -f='${Version}\n' openssh-client 2>/dev/null || true)
  fi
  [ -z "$pkgver" ] && return 1

  version_src="dpkg"
  version_val="$pkgver"

  # Known fixed distro package versions from vendor advisories.
  if dpkg --compare-versions "$pkgver" ge '1:10.3p1-1'; then fixed_by_pkg=1; return 0; fi
  if dpkg --compare-versions "$pkgver" ge '1:10.2p1-2ubuntu3.2'; then fixed_by_pkg=1; return 0; fi
  if dpkg --compare-versions "$pkgver" ge '1:10.0p1-5ubuntu5.4'; then fixed_by_pkg=1; return 0; fi
  if dpkg --compare-versions "$pkgver" ge '1:9.6p1-3ubuntu13.16'; then fixed_by_pkg=1; return 0; fi
  if dpkg --compare-versions "$pkgver" ge '1:8.9p1-3ubuntu0.15'; then fixed_by_pkg=1; return 0; fi
  if dpkg --compare-versions "$pkgver" ge '1:9.2p1-2+deb12u10'; then fixed_by_pkg=1; return 0; fi
  if dpkg --compare-versions "$pkgver" ge '1:8.4p1-5+deb11u7'; then fixed_by_pkg=1; return 0; fi
  if dpkg --compare-versions "$pkgver" ge '1:10.0p1-7+deb13u3'; then fixed_by_pkg=1; return 0; fi

  vuln_by_version=1
  return 0
}

extract_upstream_version() {
  local raw="$1"
  # Extract things like 9.6p1, 10.2, 10.3p1 from package or ssh -V output.
  printf '%s' "$raw" | sed -nE 's/.*OpenSSH[_ ]([0-9]+\.[0-9]+(p[0-9]+)?).*/\1/p; t; s/.*([0-9]+\.[0-9]+(p[0-9]+)?).*/\1/p'
}

ver_ge_10_3() {
  # Returns 0 if version >= 10.3, else 1. Handles forms like 10.3, 10.3p1, 9.9p2.
  local v="$1"
  local major minor
  major=$(printf '%s' "$v" | sed -E 's/^([0-9]+)\..*/\1/')
  minor=$(printf '%s' "$v" | sed -E 's/^[0-9]+\.([0-9]+).*/\1/')
  [ -z "$major" ] && return 1
  [ -z "$minor" ] && return 1
  if [ "$major" -gt 10 ]; then return 0; fi
  if [ "$major" -lt 10 ]; then return 1; fi
  [ "$minor" -ge 3 ]
}

check_raw_version() {
  local raw=""
  if have_cmd ssh; then
    raw=$(ssh -V 2>&1 | head -n1)
  elif have_cmd sshd; then
    raw=$(sshd -V 2>&1 | head -n1)
  fi
  [ -z "$raw" ] && return 1

  version_src="binary"
  version_val="$raw"
  local up
  up=$(extract_upstream_version "$raw")
  [ -z "$up" ] && return 1

  if ver_ge_10_3 "$up"; then
    fixed_by_pkg=1
  else
    vuln_by_version=1
  fi
  return 0
}

scan_authorized_keys() {
  local files=()
  local f

  # Common global and root locations
  [ -f /root/.ssh/authorized_keys ] && files+=(/root/.ssh/authorized_keys)
  [ -f /etc/ssh/authorized_keys ] && files+=(/etc/ssh/authorized_keys)

  # Enumerate local users with home directories
  if [ -r /etc/passwd ]; then
    while IFS=: read -r _ _ _ _ _ home shell; do
      [ -n "$home" ] || continue
      [ -d "$home/.ssh" ] || continue
      [ -f "$home/.ssh/authorized_keys" ] && files+=("$home/.ssh/authorized_keys")
      [ -f "$home/.ssh/authorized_keys2" ] && files+=("$home/.ssh/authorized_keys2")
    done < /etc/passwd
  fi

  for f in "${files[@]}"; do
    [ -r "$f" ] || continue
    if grep -Eqi 'cert-authority' "$f" && grep -Eqi 'principals="[^"]*,[^"]*"' "$f"; then
      risky_cfg=1
      reason="Found cert-authority with multi-principal principals= in $f"
      return 0
    fi
  done
  return 0
}

# Main
check_dpkg_fixed || true
if [ "$fixed_by_pkg" -eq 0 ] && [ "$vuln_by_version" -eq 0 ]; then
  check_raw_version || true
fi

scan_authorized_keys

if [ "$fixed_by_pkg" -eq 1 ]; then
  status="PATCHED"
  if [ -z "$reason" ]; then
    reason="Installed package/version appears fixed (${version_src}: ${version_val})"
  fi
  printf '%s - %s\n' "$status" "$reason"
  exit 0
fi

if [ "$vuln_by_version" -eq 1 ] && [ "$risky_cfg" -eq 1 ]; then
  status="VULNERABLE"
  if [ -z "$reason" ]; then
    reason="Vulnerable version plus risky authorized_keys pattern detected"
  else
    reason="Vulnerable version (${version_src}: ${version_val}) and risky config: ${reason}"
  fi
  printf '%s - %s\n' "$status" "$reason"
  exit 1
fi

status="UNKNOWN"
if [ "$vuln_by_version" -eq 1 ]; then
  reason="Version appears vulnerable (${version_src}: ${version_val}) but no readable risky authorized_keys pattern was confirmed"
else
  reason="Could not determine fixed status from package/version data"
fi
printf '%s - %s\n' "$status" "$reason"
exit 2