VMware vCenter Server VMware Directory Service Authentication Bypass

#!/usr/bin/env bash
# check_cve_2026_59309.sh — Detect whether a vCenter appliance is patched for CVE-2026-59309
# Usage: bash check_cve_2026_59309.sh [vcenter_hostname_or_ip]
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

TARGET="${1:-localhost}"

# Known fixed build numbers (from VMSA-2026-0006)
# vCenter 8.0 U3k, 9.0.2.0100, 9.1.0.0300
FIXED_8x="8.0.3.00600"  # 8.0 U3k build baseline
FIXED_90="9.0.2.0100"
FIXED_91="9.1.0.0300"

echo "[*] Querying vCenter build info at https://${TARGET}..."
RESPONSE=$(curl -sk --connect-timeout 10 "https://${TARGET}/sdk/vimServiceVersions.xml" 2>/dev/null || true)

if [ -z "$RESPONSE" ]; then
  # Fallback: try the appliance API
  RESPONSE=$(curl -sk --connect-timeout 10 "https://${TARGET}/rest/appliance/system/version" 2>/dev/null || true)
fi

if [ -z "$RESPONSE" ]; then
  echo "[!] UNKNOWN — Could not connect to vCenter at ${TARGET}"
  echo "    Verify network reachability and that this is a vCenter appliance."
  exit 2
fi

# Try to extract version string
VERSION=$(echo "$RESPONSE" | grep -oP '(?<=<version>)[^<]+' 2>/dev/null || true)
BUILD=$(echo "$RESPONSE" | grep -oP '(?<=<build>)[^<]+' 2>/dev/null || true)

# Fallback: JSON API response
if [ -z "$VERSION" ]; then
  VERSION=$(echo "$RESPONSE" | grep -oP '"version"\s*:\s*"\K[^"]+' 2>/dev/null || true)
  BUILD=$(echo "$RESPONSE" | grep -oP '"build"\s*:\s*"\K[^"]+' 2>/dev/null || true)
fi

if [ -z "$VERSION" ]; then
  echo "[!] UNKNOWN — Connected but could not parse version info."
  echo "    Raw response (first 500 chars):"
  echo "$RESPONSE" | head -c 500
  exit 2
fi

echo "[*] Detected vCenter version: ${VERSION} (build: ${BUILD:-unknown})"

# Version comparison
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)

version_gte() {
  # Returns 0 if $1 >= $2 using sort -V
  [ "$(printf '%s\n%s' "$1" "$2" | sort -V | head -n1)" = "$2" ]
}

case "${MAJOR}.${MINOR}" in
  8.0)
    if version_gte "$VERSION" "$FIXED_8x"; then
      echo "[+] PATCHED — vCenter ${VERSION} is at or above 8.0 U3k."
      exit 0
    else
      echo "[-] VULNERABLE — vCenter ${VERSION} is below 8.0 U3k (${FIXED_8x})."
      echo "    Apply vCenter 8.0 Update 3k immediately."
      exit 1
    fi
    ;;
  9.0)
    if version_gte "$VERSION" "$FIXED_90"; then
      echo "[+] PATCHED — vCenter ${VERSION} is at or above ${FIXED_90}."
      exit 0
    else
      echo "[-] VULNERABLE — vCenter ${VERSION} is below ${FIXED_90}."
      echo "    Apply vSphere Foundation 9.0.2.0100 immediately."
      exit 1
    fi
    ;;
  9.1)
    if version_gte "$VERSION" "$FIXED_91"; then
      echo "[+] PATCHED — vCenter ${VERSION} is at or above ${FIXED_91}."
      exit 0
    else
      echo "[-] VULNERABLE — vCenter ${VERSION} is below ${FIXED_91}."
      echo "    Apply vSphere Foundation 9.1.0.0300 immediately."
      exit 1
    fi
    ;;
  7.*|6.*)
    echo "[-] VULNERABLE — vCenter ${VERSION} is end-of-support."
    echo "    No patch available. Upgrade to a supported branch immediately."
    exit 1
    ;;
  *)
    echo "[!] UNKNOWN — Unrecognized vCenter version: ${VERSION}"
    exit 2
    ;;
esac