VMware vCenter Server Syslog rsyslog Dynafile Path Traversal to Pre-Auth Root RCE

#!/bin/bash
# CVE-2026-59310 Vulnerability Check — VMware vCenter Server Appliance
# Checks for the secpath-replace fix in rsyslog dynafile templates.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -uo pipefail

CONF="/usr/lib/vmware-visl-integration/config/vmware-syslog.conf.template"
CRON_DIR="/etc/cron.d"
VAMI_ROOT="/opt/vmware/share/htdocs"
RESULT="UNKNOWN"
EXIT_CODE=2

echo "=== CVE-2026-59310 Vulnerability Check ==="
echo "Date: $(date -u '+%Y-%m-%d %H:%M:%S UTC')"
echo "Host: $(hostname -f 2>/dev/null || hostname)"
echo ""

# 1. Check vCenter version
if command -v vpxd &>/dev/null; then
    VPXD_VER=$(vpxd -v 2>/dev/null | head -1)
    echo "[INFO] vCenter version: ${VPXD_VER:-unknown}"
else
    echo "[WARN] vpxd binary not found — is this a VCSA?"
fi
echo ""

# 2. Definitive check: does the rsyslog template use secpath-replace?
if [ -f "$CONF" ]; then
    SECPATH_COUNT=$(grep -c 'secpath-replace' "$CONF" 2>/dev/null || true)
    if [ "$SECPATH_COUNT" -ge 1 ]; then
        echo "[PASS] rsyslog template contains secpath-replace ($SECPATH_COUNT occurrences)."
        RESULT="PATCHED"
        EXIT_CODE=0
    else
        echo "[FAIL] rsyslog template does NOT contain secpath-replace."
        RESULT="VULNERABLE"
        EXIT_CODE=1
    fi
else
    echo "[WARN] Config not found at $CONF"
    echo "[WARN] Falling back to running rsyslog config check."
    RUNNING_CONF=$(rsyslogd -N1 2>&1 || true)
    if echo "$RUNNING_CONF" | grep -q 'secpath-replace'; then
        echo "[PASS] Running rsyslog config contains secpath-replace."
        RESULT="PATCHED"
        EXIT_CODE=0
    elif echo "$RUNNING_CONF" | grep -q 'dynaFile'; then
        echo "[FAIL] Running rsyslog config has dynaFile templates WITHOUT secpath-replace."
        RESULT="VULNERABLE"
        EXIT_CODE=1
    else
        echo "[WARN] Cannot determine rsyslog configuration status."
    fi
fi
echo ""

# 3. Check if syslog ports are listening (exposure indicator)
echo "[INFO] Syslog port exposure:"
for PORT in 514 6514; do
    TCP_LISTEN=$(ss -tlnp 2>/dev/null | grep ":${PORT} " || true)
    UDP_LISTEN=$(ss -ulnp 2>/dev/null | grep ":${PORT} " || true)
    if [ -n "$TCP_LISTEN" ] || [ -n "$UDP_LISTEN" ]; then
        echo "  Port ${PORT}: LISTENING"
        [ -n "$TCP_LISTEN" ] && echo "    TCP: $TCP_LISTEN"
        [ -n "$UDP_LISTEN" ] && echo "    UDP: $UDP_LISTEN"
    else
        echo "  Port ${PORT}: not listening"
    fi
done
echo ""

# 4. IOC spot check: look for known exploitation artifacts
echo "[INFO] IOC spot check:"
IOC_FOUND=0
for ARTIFACT in "zz-poc59310" "zz-poc59310-syslog.log" "vmware-perf-update.jsp"; do
    HITS=$(find "$CRON_DIR" "$VAMI_ROOT" -name "$ARTIFACT" 2>/dev/null || true)
    if [ -n "$HITS" ]; then
        echo "  [ALERT] Found exploitation artifact: $HITS"
        IOC_FOUND=1
    fi
done
# Check for suspicious cron entries
SUSPICIOUS_CRON=$(grep -rl 'poc59310\|se9ly9upbhay\|185\.144\.28\.120\|5\.34\.176\.100' "$CRON_DIR" 2>/dev/null || true)
if [ -n "$SUSPICIOUS_CRON" ]; then
    echo "  [ALERT] Suspicious cron entries found: $SUSPICIOUS_CRON"
    IOC_FOUND=1
fi
if [ "$IOC_FOUND" -eq 0 ]; then
    echo "  No known IOCs detected (not exhaustive)."
fi
echo ""

echo "=== Result: $RESULT ==="
exit $EXIT_CODE