Roundcube Webmail Pre-Authentication SQL Injection via virtuser_query Plugin preg_replace Backslash Bypass

#!/usr/bin/env bash
# check_cve_2026_48842.sh — Detect CVE-2026-48842 (Roundcube virtuser_query pre-auth SQLi)
# Usage: bash check_cve_2026_48842.sh /path/to/roundcube
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

RC_DIR="${1:-/var/www/roundcube}"
STATUS="UNKNOWN"

# Locate version file
VERSION_FILE=""
for candidate in "$RC_DIR/program/include/iniset.php" "$RC_DIR/index.php" "$RC_DIR/program/lib/Roundcube/rcube.php"; do
  if [[ -f "$candidate" ]]; then
    VERSION_FILE="$candidate"
    break
  fi
done

if [[ -z "$VERSION_FILE" ]]; then
  echo "[!] Cannot find Roundcube installation at $RC_DIR"
  echo "UNKNOWN"
  exit 2
fi

# Extract version
VERSION=$(grep -oP "define\\('RCMAIL_VERSION',\\s*'\\K[^']+" "$RC_DIR/program/include/iniset.php" 2>/dev/null || \
          grep -oP "'version'\\s*=>\\s*'\\K[^']+" "$RC_DIR/composer.json" 2>/dev/null || \
          echo "")

if [[ -z "$VERSION" ]]; then
  echo "[!] Could not determine Roundcube version"
  echo "UNKNOWN"
  exit 2
fi

echo "[*] Roundcube version: $VERSION"

# Check if virtuser_query plugin is enabled
CONFIG_FILE="$RC_DIR/config/config.inc.php"
PLUGIN_ENABLED=false
if [[ -f "$CONFIG_FILE" ]]; then
  if grep -qP "['\"]virtuser_query['\"]" "$CONFIG_FILE" 2>/dev/null; then
    PLUGIN_ENABLED=true
    echo "[!] virtuser_query plugin is ENABLED in config"
  else
    echo "[*] virtuser_query plugin is NOT enabled in config"
  fi
else
  echo "[!] Config file not found at $CONFIG_FILE"
fi

# Check if the vulnerable preg_replace pattern exists in the plugin
PLUGIN_FILE="$RC_DIR/plugins/virtuser_query/virtuser_query.php"
USES_PREG=false
if [[ -f "$PLUGIN_FILE" ]]; then
  if grep -q 'preg_replace' "$PLUGIN_FILE" 2>/dev/null; then
    USES_PREG=true
    echo "[!] Plugin code uses vulnerable preg_replace() pattern"
  else
    echo "[*] Plugin code uses safe str_replace() pattern (patched)"
  fi
else
  echo "[*] virtuser_query plugin file not found (plugin not installed)"
  echo "PATCHED"
  exit 0
fi

# Version comparison
version_gte() {
  printf '%s\n%s' "$2" "$1" | sort -V -C
}

# Determine vulnerability status
if [[ "$VERSION" == 1.6.* ]]; then
  if version_gte "$VERSION" "1.6.16"; then
    STATUS="PATCHED"
  else
    STATUS="VULNERABLE"
  fi
elif [[ "$VERSION" == 1.7.* ]]; then
  if version_gte "$VERSION" "1.7.1"; then
    STATUS="PATCHED"
  else
    STATUS="VULNERABLE"
  fi
elif [[ "$VERSION" == 1.5.* ]] || [[ "$VERSION" == 1.4.* ]]; then
  STATUS="VULNERABLE"
  echo "[!] EOL version detected — likely vulnerable if plugin is present"
else
  # 1.8+ or unknown
  STATUS="UNKNOWN"
fi

# Override: if plugin uses str_replace (patched code), mark patched regardless
if [[ "$USES_PREG" == false ]]; then
  STATUS="PATCHED"
fi

# Final output
if [[ "$STATUS" == "VULNERABLE" ]]; then
  if [[ "$PLUGIN_ENABLED" == true ]]; then
    echo "[!!!] VULNERABLE — version $VERSION with virtuser_query ENABLED and unpatched preg_replace()"
    echo "VULNERABLE"
    exit 1
  else
    echo "[!] VULNERABLE (code) but plugin not enabled — exploitability requires config change"
    echo "VULNERABLE"
    exit 1
  fi
elif [[ "$STATUS" == "PATCHED" ]]; then
  echo "[*] PATCHED — version $VERSION or plugin code uses safe str_replace()"
  echo "PATCHED"
  exit 0
else
  echo "[?] UNKNOWN — could not conclusively determine status"
  echo "UNKNOWN"
  exit 2
fi