Roundcube Webmail 1

#!/usr/bin/env bash
# verify_cve_2026_48842.sh
# Check Roundcube CVE-2026-48842 exposure.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

TARGET="${1:-}"

find_root() {
  local candidates=()
  if [[ -n "$TARGET" ]]; then
    candidates+=("$TARGET")
  fi
  candidates+=(
    "/var/www/roundcube"
    "/var/lib/roundcube"
    "/usr/share/roundcube"
    "/usr/share/roundcubemail"
    "/opt/roundcube"
    "/srv/roundcube"
  )

  for d in "${candidates[@]}"; do
    [[ -d "$d" ]] || continue
    if [[ -f "$d/index.php" && -d "$d/plugins" ]]; then
      echo "$d"
      return 0
    fi
  done
  return 1
}

version_ge() {
  # returns 0 if $1 >= $2
  if command -v dpkg >/dev/null 2>&1; then
    dpkg --compare-versions "$1" ge "$2"
    return $?
  fi
  [[ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n1)" == "$2" ]]
}

version_lt() {
  # returns 0 if $1 < $2
  if command -v dpkg >/dev/null 2>&1; then
    dpkg --compare-versions "$1" lt "$2"
    return $?
  fi
  [[ "$1" != "$2" ]] && [[ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" == "$1" ]]
}

extract_version() {
  local root="$1"
  local v=""

  # Debian/RPM package versions first
  if command -v dpkg-query >/dev/null 2>&1; then
    v="$(dpkg-query -W -f='${Version}' roundcube 2>/dev/null || true)"
    if [[ -n "$v" ]]; then
      echo "$v"
      return 0
    fi
    v="$(dpkg-query -W -f='${Version}' roundcube-core 2>/dev/null || true)"
    if [[ -n "$v" ]]; then
      echo "$v"
      return 0
    fi
  fi

  if command -v rpm >/dev/null 2>&1; then
    v="$(rpm -q --qf '%{VERSION}-%{RELEASE}' roundcubemail 2>/dev/null || true)"
    if [[ -n "$v" && "$v" != *"not installed"* ]]; then
      echo "$v"
      return 0
    fi
  fi

  # Source installs: try common metadata files
  if [[ -f "$root/composer.json" ]]; then
    v="$(grep -Eo '"version"[[:space:]]*:[[:space:]]*"[^"]+"' "$root/composer.json" 2>/dev/null | head -n1 | sed -E 's/.*"([0-9][^"]*)"/\1/')"
    if [[ -n "$v" ]]; then
      echo "$v"
      return 0
    fi
  fi

  if [[ -f "$root/program/include/iniset.php" ]]; then
    v="$(grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' "$root/program/include/iniset.php" 2>/dev/null | head -n1)"
    if [[ -n "$v" ]]; then
      echo "$v"
      return 0
    fi
  fi

  if [[ -f "$root/CHANGELOG.md" ]]; then
    v="$(grep -Eo 'Release[[:space:]]+[0-9]+\.[0-9]+\.[0-9]+' "$root/CHANGELOG.md" 2>/dev/null | head -n1 | awk '{print $2}')"
    if [[ -n "$v" ]]; then
      echo "$v"
      return 0
    fi
  fi

  return 1
}

plugin_enabled() {
  local root="$1"
  local cfg="$root/config/config.inc.php"
  [[ -f "$cfg" ]] || return 2

  # Best-effort parse: strip comments, then look for virtuser_query token.
  local content
  content="$(sed -E 's://.*$::; s:#.*$::' "$cfg" 2>/dev/null | tr '\n' ' ')"
  if echo "$content" | grep -Eq "plugins[^;]*virtuser_query"; then
    return 0
  fi
  return 1
}

ROOT="$(find_root || true)"
if [[ -z "$ROOT" ]]; then
  echo "UNKNOWN - Roundcube root not found"
  exit 2
fi

VER="$(extract_version "$ROOT" || true)"
if [[ -z "$VER" ]]; then
  echo "UNKNOWN - Could not determine Roundcube version under $ROOT"
  exit 2
fi

plugin_enabled "$ROOT"
PLUGIN_RC=$?
if [[ $PLUGIN_RC -eq 2 ]]; then
  echo "UNKNOWN - Config file missing at $ROOT/config/config.inc.php"
  exit 2
fi
if [[ $PLUGIN_RC -ne 0 ]]; then
  echo "PATCHED - virtuser_query not enabled in $ROOT/config/config.inc.php (CVE-2026-48842 path not active)"
  exit 0
fi

# Normalize upstream version prefix if package release suffixes exist.
UPSTREAM="$(echo "$VER" | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)"
if [[ -z "$UPSTREAM" ]]; then
  echo "UNKNOWN - Parsed package version '$VER' but no upstream semantic version found"
  exit 2
fi

# Vulnerable logic:
# 1.6.x before 1.6.16
# 1.7.x before 1.7.1 (practically 1.7.0)
if [[ "$UPSTREAM" =~ ^1\.6\.[0-9]+$ ]]; then
  if version_lt "$UPSTREAM" "1.6.16"; then
    echo "VULNERABLE - Roundcube $VER with virtuser_query enabled"
    exit 1
  else
    echo "PATCHED - Roundcube $VER with virtuser_query enabled, but >= 1.6.16"
    exit 0
  fi
elif [[ "$UPSTREAM" =~ ^1\.7\.[0-9]+$ ]]; then
  if version_lt "$UPSTREAM" "1.7.1"; then
    echo "VULNERABLE - Roundcube $VER with virtuser_query enabled"
    exit 1
  else
    echo "PATCHED - Roundcube $VER with virtuser_query enabled, but >= 1.7.1"
    exit 0
  fi
else
  echo "PATCHED - Roundcube $VER is outside the stated affected upstream branches, though plugin state was checked"
  exit 0
fi