Hoppscotch Backend Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite

#!/usr/bin/env bash
# check_cve_2026_50160.sh — CVE-2026-50160 Hoppscotch Mass Assignment Check
# Usage: bash check_cve_2026_50160.sh <BASE_URL>
# Example: bash check_cve_2026_50160.sh http://10.0.1.50:3170
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

BASE_URL="${1:-}"
if [[ -z "$BASE_URL" ]]; then
  echo "Usage: $0 <HOPPSCOTCH_BACKEND_URL>"
  echo "Example: $0 http://localhost:3170"
  exit 2
fi

# Strip trailing slash
BASE_URL="${BASE_URL%/}"

echo "[*] Checking CVE-2026-50160 against $BASE_URL"

# Step 1: Check if the backend is reachable
HTTP_CODE=$(curl -s -o /dev/null -w '%{http_code}' --connect-timeout 5 "$BASE_URL/" 2>/dev/null || true)
if [[ -z "$HTTP_CODE" || "$HTTP_CODE" == "000" ]]; then
  echo "[!] Cannot reach $BASE_URL"
  echo "UNKNOWN"
  exit 2
fi
echo "[*] Backend reachable (HTTP $HTTP_CODE)"

# Step 2: Check onboarding status (the key risk indicator)
ONBOARD_RESP=$(curl -s --connect-timeout 5 "$BASE_URL/v1/onboarding/status" 2>/dev/null || true)
if [[ -z "$ONBOARD_RESP" ]]; then
  echo "[!] Could not query onboarding status endpoint"
  echo "UNKNOWN"
  exit 2
fi

echo "[*] Onboarding status response: $ONBOARD_RESP"

# Step 3: Parse onboarding completion status
# If onboarding is NOT complete and usersCount is 0, the instance is actively vulnerable
if echo "$ONBOARD_RESP" | grep -qiE '"(is_setup_done|isSetupDone|completed)"\s*:\s*false'; then
  echo "[!] Onboarding is NOT complete — endpoint is exploitable!"
  echo ""
  echo "VULNERABLE"
  echo ""
  echo "ACTION: Complete onboarding immediately or block external access."
  echo "        Then upgrade to Hoppscotch >= 2026.5.0."
  exit 1
fi

if echo "$ONBOARD_RESP" | grep -qiE '"(is_setup_done|isSetupDone|completed)"\s*:\s*true'; then
  echo "[*] Onboarding is complete — endpoint is no longer exploitable."
  echo "[*] NOTE: You should still upgrade to >= 2026.5.0 to fix the"
  echo "         underlying mass-assignment flaw for future redeployments."
  echo ""
  # Check if we can infer version
  # Try the config endpoint to see if whitelist is enforced (patched behavior)
  PROBE_CODE=$(curl -s -o /dev/null -w '%{http_code}' --connect-timeout 5 \
    -X POST "$BASE_URL/v1/onboarding/config" \
    -H 'Content-Type: application/json' \
    -d '{"__noisgate_probe": "test"}' 2>/dev/null || true)
  if [[ "$PROBE_CODE" == "400" || "$PROBE_CODE" == "422" ]]; then
    echo "[*] Probe returned $PROBE_CODE — ValidationPipe likely rejects unknown properties (patched)."
    echo "PATCHED"
    exit 0
  elif [[ "$PROBE_CODE" == "401" || "$PROBE_CODE" == "403" ]]; then
    echo "[*] Probe returned $PROBE_CODE — endpoint requires auth (patched or onboarding gated)."
    echo "PATCHED"
    exit 0
  else
    echo "[*] Probe returned $PROBE_CODE — cannot confirm patch status."
    echo "[*] Verify you are running Hoppscotch >= 2026.5.0 manually."
    echo "UNKNOWN"
    exit 2
  fi
fi

echo "[!] Could not parse onboarding status response."
echo "UNKNOWN"
exit 2