RSFiles! Joomla Component Unauthenticated Arbitrary File Upload to RCE

#!/usr/bin/env bash
# check_cve_2026_57827.sh — Detect RSFiles! < 1.17.12 (CVE-2026-57827)
# Usage: bash check_cve_2026_57827.sh <JOOMLA_BASE_URL>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

URL="${1:-}"
if [[ -z "$URL" ]]; then
  echo "Usage: $0 <JOOMLA_BASE_URL>"
  exit 2
fi

# Strip trailing slash
URL="${URL%/}"

echo "[*] Checking $URL for CVE-2026-57827 (RSFiles! < 1.17.12)"

# Method 1: Check if com_rsfiles is reachable
HTTP_CODE=$(curl -sk -o /dev/null -w '%{http_code}' "${URL}/index.php?option=com_rsfiles" 2>/dev/null || echo "000")
if [[ "$HTTP_CODE" == "000" ]]; then
  echo "[!] Cannot reach target. Check URL and connectivity."
  echo "UNKNOWN"
  exit 2
fi

if [[ "$HTTP_CODE" == "404" ]] || [[ "$HTTP_CODE" == "500" ]]; then
  echo "[+] com_rsfiles not found (HTTP $HTTP_CODE). Component likely not installed."
  echo "PATCHED"
  exit 0
fi

echo "[*] com_rsfiles responded with HTTP $HTTP_CODE — component is present."

# Method 2: Try to read the manifest version from the filesystem (local only)
MANIFEST="/administrator/components/com_rsfiles/rsfiles.xml"
if [[ -f "$MANIFEST" ]]; then
  VERSION=$(grep -oP '<version>\K[^<]+' "$MANIFEST" 2>/dev/null || echo "")
  if [[ -n "$VERSION" ]]; then
    echo "[*] Local manifest version: $VERSION"
    # Compare version — vulnerable if < 1.17.12
    MAJOR=$(echo "$VERSION" | cut -d. -f1)
    MINOR=$(echo "$VERSION" | cut -d. -f2)
    PATCH=$(echo "$VERSION" | cut -d. -f3)
    if [[ "$MAJOR" -lt 1 ]] || \
       [[ "$MAJOR" -eq 1 && "$MINOR" -lt 17 ]] || \
       [[ "$MAJOR" -eq 1 && "$MINOR" -eq 17 && "$PATCH" -lt 12 ]]; then
      echo "[!] RSFiles! $VERSION is VULNERABLE (< 1.17.12)"
      echo "VULNERABLE"
      exit 1
    else
      echo "[+] RSFiles! $VERSION is PATCHED (>= 1.17.12)"
      echo "PATCHED"
      exit 0
    fi
  fi
fi

# Method 3: Remote version check via manifest XML (often accessible)
REMOTE_XML=$(curl -sk "${URL}/administrator/components/com_rsfiles/rsfiles.xml" 2>/dev/null || echo "")
if echo "$REMOTE_XML" | grep -q '<version>'; then
  VERSION=$(echo "$REMOTE_XML" | grep -oP '<version>\K[^<]+' || echo "")
  if [[ -n "$VERSION" ]]; then
    echo "[*] Remote manifest version: $VERSION"
    MAJOR=$(echo "$VERSION" | cut -d. -f1)
    MINOR=$(echo "$VERSION" | cut -d. -f2)
    PATCH=$(echo "$VERSION" | cut -d. -f3)
    if [[ "$MAJOR" -lt 1 ]] || \
       [[ "$MAJOR" -eq 1 && "$MINOR" -lt 17 ]] || \
       [[ "$MAJOR" -eq 1 && "$MINOR" -eq 17 && "$PATCH" -lt 12 ]]; then
      echo "[!] RSFiles! $VERSION is VULNERABLE (< 1.17.12)"
      echo "VULNERABLE"
      exit 1
    else
      echo "[+] RSFiles! $VERSION is PATCHED (>= 1.17.12)"
      echo "PATCHED"
      exit 0
    fi
  fi
fi

# Method 4: Probe the vulnerable endpoint (safe — no actual upload)
# A HEAD/OPTIONS to the upload task; patched versions return 403 or require token
PROBE_CODE=$(curl -sk -o /dev/null -w '%{http_code}' -X OPTIONS "${URL}/index.php?option=com_rsfiles&task=rsfiles.upload" 2>/dev/null || echo "000")
echo "[*] Upload endpoint probe returned HTTP $PROBE_CODE"
if [[ "$PROBE_CODE" == "200" ]]; then
  echo "[!] Upload endpoint is accessible without authentication — likely VULNERABLE"
  echo "VULNERABLE"
  exit 1
elif [[ "$PROBE_CODE" == "403" ]] || [[ "$PROBE_CODE" == "302" ]]; then
  echo "[+] Upload endpoint returned $PROBE_CODE — likely PATCHED or protected"
  echo "PATCHED"
  exit 0
fi

echo "[?] Could not definitively determine RSFiles! version or patch status."
echo "UNKNOWN"
exit 2