Rancher Manager Command Injection via Unsanitized authImage YAML Parameter in Cluster Import Endpoint

#!/usr/bin/env bash
# CVE-2026-44939 Checker — Rancher Manager YAML Injection
# Detects vulnerable Rancher versions and checks for exploitation indicators.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN
set -uo pipefail

RANCHER_NS="${RANCHER_NAMESPACE:-cattle-system}"
VULNERABLE=0
UNKNOWN=0

# --- Step 1: Determine Rancher version ---
IMAGE=""
for deploy in rancher rancher-server; do
  IMAGE=$(kubectl get deployment "$deploy" -n "$RANCHER_NS" \
    -o jsonpath='{.spec.template.spec.containers[0].image}' 2>/dev/null || true)
  [ -n "$IMAGE" ] && break
done

if [ -z "$IMAGE" ]; then
  IMAGE=$(kubectl get pods -n "$RANCHER_NS" -l app=rancher \
    -o jsonpath='{.items[0].spec.containers[0].image}' 2>/dev/null || true)
fi

if [ -z "$IMAGE" ]; then
  echo "[!] Could not detect Rancher deployment in namespace '$RANCHER_NS'."
  echo "UNKNOWN"
  exit 2
fi

TAG=$(echo "$IMAGE" | grep -oP '(?<=:v)[0-9]+\.[0-9]+\.[0-9]+' || true)
if [ -z "$TAG" ]; then
  echo "[!] Could not parse version from image: $IMAGE"
  echo "UNKNOWN"
  exit 2
fi

echo "[*] Detected Rancher image: $IMAGE"
echo "[*] Parsed version: v${TAG}"

IFS='.' read -r MAJ MIN PAT <<< "$TAG"

# --- Step 2: Check version against vulnerable ranges ---
if [ "$MAJ" -eq 2 ]; then
  if [ "$MIN" -eq 14 ] && [ "$PAT" -lt 2 ]; then
    VULNERABLE=1
  elif [ "$MIN" -eq 13 ] && [ "$PAT" -lt 6 ]; then
    VULNERABLE=1
  elif [ "$MIN" -eq 12 ] && [ "$PAT" -lt 10 ]; then
    VULNERABLE=1
  elif [ "$MIN" -eq 11 ] && [ "$PAT" -lt 14 ]; then
    VULNERABLE=1
  elif [ "$MIN" -eq 10 ] && [ "$PAT" -lt 12 ]; then
    VULNERABLE=1
  elif [ "$MIN" -lt 10 ]; then
    VULNERABLE=1
  fi
fi

# --- Step 3: Check for exploitation indicators ---
echo ""
echo "[*] Checking for exploitation indicators in '$RANCHER_NS' namespace..."
SUSPICIOUS=$(kubectl get daemonsets -n "$RANCHER_NS" -o json 2>/dev/null | \
  python3 -c "
import sys, json
try:
    data = json.load(sys.stdin)
    for ds in data.get('items', []):
        name = ds['metadata']['name']
        spec = ds['spec']['template']['spec']
        for c in spec.get('containers', []):
            if 'command' in c and c.get('name','') not in ('rancher-agent','cluster-agent','kube-api-auth'):
                print(f'  ALERT: DaemonSet {name} container {c["name"]} has unexpected command: {c["command"]}')
            img = c.get('image','')
            if img and 'rancher' not in img.lower() and 'cattle' not in img.lower():
                print(f'  ALERT: DaemonSet {name} container {c["name"]} uses non-Rancher image: {img}')
        if spec.get('hostNetwork') and name not in ('cattle-node-agent','kube-api-auth'):
            print(f'  ALERT: DaemonSet {name} has hostNetwork:true (unexpected)')
except Exception as e:
    print(f'  (inspection error: {e})')
" 2>/dev/null || echo "  (could not inspect DaemonSets — python3 may not be available)")

if [ -n "$SUSPICIOUS" ]; then
  echo "$SUSPICIOUS"
else
  echo "  No exploitation indicators found."
fi

# --- Step 4: Final verdict ---
echo ""
if [ "$VULNERABLE" -eq 1 ]; then
  echo "VULNERABLE — Rancher v${TAG} is affected by CVE-2026-44939."
  echo "  Upgrade to: 2.14.2 / 2.13.6 / 2.12.10 / 2.11.14 / 2.10.12"
  exit 1
else
  echo "PATCHED — Rancher v${TAG} is not affected by CVE-2026-44939."
  exit 0
fi