Improper authentication in Azure Local Disconnected Operations

# Test-CVE-2026-42822.ps1

# Checks for Azure Local Disconnected Operations version evidence and compares it

# to the fixed version floor for CVE-2026-42822.

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


[CmdletBinding()]
param(
    [Parameter(Mandatory=$false)]
    [string]$FixedVersion = '2604.2.25645'
)

function Convert-ToVersionArray {
    param([string]$Version)
    if ([string]::IsNullOrWhiteSpace($Version)) { return $null }
    $parts = $Version -split '\.'
    $nums = @()
    foreach ($p in $parts) {
        if ($p -notmatch '^\d+$') { return $null }
        $nums += [int]$p
    }
    return ,$nums
}

function Compare-VersionString {
    param(
        [string]$A,
        [string]$B
    )
    $va = Convert-ToVersionArray $A
    $vb = Convert-ToVersionArray $B
    if ($null -eq $va -or $null -eq $vb) { throw "Invalid version comparison: '$A' vs '$B'" }

    $max = [Math]::Max($va.Count, $vb.Count)
    for ($i = 0; $i -lt $max; $i++) {
        $ai = if ($i -lt $va.Count) { $va[$i] } else { 0 }
        $bi = if ($i -lt $vb.Count) { $vb[$i] } else { 0 }
        if ($ai -lt $bi) { return -1 }
        if ($ai -gt $bi) { return 1 }
    }
    return 0
}

function Get-VersionFromTextFile {
    param([string]$Path)
    try {
        if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) { return $null }
        $raw = Get-Content -LiteralPath $Path -Raw -ErrorAction Stop

        # Prefer Azure Local style versions such as 2604.2.25645

        $matches = [regex]::Matches($raw, '\b\d{4}\.\d+\.\d{4,5}\b')
        if ($matches.Count -gt 0) {
            $versions = $matches | ForEach-Object { $_.Value } | Sort-Object -Unique
            return $versions[-1]
        }

        # Fallback to generic x.y.z(.w) versions

        $matches = [regex]::Matches($raw, '\b\d+\.\d+\.\d+(?:\.\d+)?\b')
        if ($matches.Count -gt 0) {
            $versions = $matches | ForEach-Object { $_.Value } | Sort-Object -Unique
            return $versions[-1]
        }
    }
    catch {
        return $null
    }
    return $null
}

function Add-Candidate {
    param(
        [ref]$List,
        [string]$Source,
        [string]$Version
    )
    if (-not [string]::IsNullOrWhiteSpace($Version)) {
        $List.Value += [pscustomobject]@{
            Source  = $Source
            Version = $Version
        }
    }
}

$candidates = @()

# Common disconnected-operations paths documented by Microsoft Learn

$pathsToProbe = @(
    'C:\AzureLocalDisconnectedOperations\AzureLocal.DisconnectedOperations.Appliance.manifest',
    'C:\AzureLocalDisconnectedOperations\OperationsModule\Azure.Local.DisconnectedOperations.psd1',
    'C:\AzureLocalDisconnectedOperations\OperationsModule\Azure.Local.DisconnectedOperations.psm1',
    'C:\azurelocal\OperationsModule\Azure.Local.DisconnectedOperations.psd1'
)

foreach ($p in $pathsToProbe) {
    $ver = Get-VersionFromTextFile -Path $p
    Add-Candidate -List ([ref]$candidates) -Source $p -Version $ver
}

# Probe installed PowerShell modules if present

try {
    $mods = Get-Module -ListAvailable 'Azure.Local.DisconnectedOperations' -ErrorAction SilentlyContinue |
        Sort-Object Version -Descending
    foreach ($m in $mods) {
        if ($m.Version) {
            Add-Candidate -List ([ref]$candidates) -Source ("Module:" + $m.Path) -Version $m.Version.ToString()
        }
    }
}
catch {}

# Probe uninstall registry for any Azure Local disconnected operations package

$regPaths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
foreach ($rp in $regPaths) {
    try {
        Get-ItemProperty $rp -ErrorAction SilentlyContinue | ForEach-Object {
            $name = $_.DisplayName
            $ver  = $_.DisplayVersion
            if ($name -and $name -match 'Azure Local|Disconnected Operations' -and $ver) {
                Add-Candidate -List ([ref]$candidates) -Source ("Registry:" + $name) -Version $ver
            }
        }
    }
    catch {}
}

if ($candidates.Count -eq 0) {
    Write-Output 'UNKNOWN: No Azure Local Disconnected Operations version evidence found on this host.'
    exit 2
}

# Select the highest parseable version discovered

$best = $null
foreach ($c in $candidates) {
    try {
        if ($null -eq $best) {
            $best = $c
            continue
        }
        if ((Compare-VersionString -A $c.Version -B $best.Version) -gt 0) {
            $best = $c
        }
    }
    catch {
        continue
    }
}

if ($null -eq $best) {
    Write-Output 'UNKNOWN: Version evidence was found but could not be parsed.'
    exit 2
}

try {
    $cmp = Compare-VersionString -A $best.Version -B $FixedVersion
    if ($cmp -lt 0) {
        Write-Output ("VULNERABLE: Detected version {0} from {1}; fixed floor is {2}." -f $best.Version, $best.Source, $FixedVersion)
        exit 1
    }
    else {
        Write-Output ("PATCHED: Detected version {0} from {1}; fixed floor is {2}." -f $best.Version, $best.Source, $FixedVersion)
        exit 0
    }
}
catch {
    Write-Output ("UNKNOWN: Failed to compare detected version '{0}' with fixed floor '{1}'. Error: {2}" -f $best.Version, $FixedVersion, $_.Exception.Message)
    exit 2
}