Oracle Payments File Transmission Unauthenticated Arbitrary File Read

#!/usr/bin/env bash
# check_cve_2026_46817.sh — Verify Oracle EBS patch status for CVE-2026-46817
# Run on: Oracle EBS application-tier host
# Privileges: Oracle applmgr user (needs read access to adpatch logs)
# Output: VULNERABLE / PATCHED / UNKNOWN

set -euo pipefail

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

echo "=== CVE-2026-46817 Check: Oracle Payments File Transmission ==="
echo "Date: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
echo ""

# Method 1: Check if the May 2026 CPU is applied via adpatch log
CPU_APPLIED=0
if command -v adpatch &>/dev/null || [ -d "${APPL_TOP:-/dev/null}" ]; then
  # Look for the May 2026 CPU patch number in applied patches
  # Oracle May 2026 CPU for EBS 12.2 — check AD_BUGS table
  if [ -n "${ORACLE_HOME:-}" ] && [ -n "${TWO_TASK:-}" ]; then
    PATCH_CHECK=$(sqlplus -S / @- <<'EOSQL' 2>/dev/null || true
SET HEADING OFF FEEDBACK OFF PAGESIZE 0
SELECT COUNT(*) FROM ad_bugs WHERE bug_number IN ('37014892','37014893','37014894') AND ROWNUM = 1;
EXIT;
EOSQL
)
    PATCH_CHECK=$(echo "$PATCH_CHECK" | tr -d '[:space:]')
    if [ "$PATCH_CHECK" = "1" ] || [ "$PATCH_CHECK" = "2" ] || [ "$PATCH_CHECK" = "3" ]; then
      CPU_APPLIED=1
    fi
  fi
fi

# Method 2: Probe the ibytransmit endpoint locally
ENDPOINT_VULN=2  # 0=not vuln, 1=vuln, 2=unknown
if [ -n "${EBS_URL:-}" ]; then
  TEST_URL="${EBS_URL}/OA_HTML/ibytransmit"
else
  # Try localhost on common EBS ports
  for PORT in 8000 8001 443 8443; do
    if curl -sk --connect-timeout 3 "https://localhost:${PORT}/OA_HTML/AppsLogin" -o /dev/null 2>/dev/null; then
      TEST_URL="https://localhost:${PORT}/OA_HTML/ibytransmit"
      break
    elif curl -sk --connect-timeout 3 "http://localhost:${PORT}/OA_HTML/AppsLogin" -o /dev/null 2>/dev/null; then
      TEST_URL="http://localhost:${PORT}/OA_HTML/ibytransmit"
      break
    fi
  done
fi

if [ -n "${TEST_URL:-}" ]; then
  # Send a benign probe — do NOT send an actual exploit payload
  # A patched endpoint returns 401/403; an unpatched one returns 200 or processes the request
  HTTP_CODE=$(curl -sk -o /dev/null -w '%{http_code}' \
    -X POST "${TEST_URL}" \
    -H 'Content-Type: text/xml' \
    -d '<?xml version="1.0"?><DeliveryRequest><test/></DeliveryRequest>' \
    --connect-timeout 5 --max-time 10 2>/dev/null || echo "000")
  
  if [ "$HTTP_CODE" = "401" ] || [ "$HTTP_CODE" = "403" ] || [ "$HTTP_CODE" = "404" ]; then
    ENDPOINT_VULN=0
  elif [ "$HTTP_CODE" = "200" ] || [ "$HTTP_CODE" = "500" ]; then
    # 200 = endpoint processes unauthenticated request (vulnerable)
    # 500 = endpoint reached unauthenticated, threw error on malformed XML (still vulnerable)
    ENDPOINT_VULN=1
  fi
fi

# Verdict
echo "--- Results ---"
if [ "$CPU_APPLIED" -eq 1 ]; then
  echo -e "${GREEN}PATCHED${NC} — May 2026 CPU patch detected in AD_BUGS table."
  exit 0
elif [ "$ENDPOINT_VULN" -eq 0 ]; then
  echo -e "${GREEN}PATCHED${NC} — /OA_HTML/ibytransmit returns $HTTP_CODE (authentication enforced)."
  exit 0
elif [ "$ENDPOINT_VULN" -eq 1 ]; then
  echo -e "${RED}VULNERABLE${NC} — /OA_HTML/ibytransmit accepts unauthenticated POST (HTTP $HTTP_CODE)."
  echo "ACTION: Apply Oracle May 2026 CPU immediately. Block /OA_HTML/ibytransmit at WAF."
  exit 1
else
  echo -e "${YELLOW}UNKNOWN${NC} — Could not determine patch status."
  echo "Verify manually: check AD_BUGS for May 2026 CPU patches, or test ibytransmit endpoint."
  echo "Set EBS_URL=https://your-ebs-host:port and re-run for endpoint probe."
  exit 2
fi