Ruflo MCP Bridge Unauthenticated RCE and AI Memory Poisoning (RufRoot)

#!/usr/bin/env bash
# CVE-2026-59726 (RufRoot) Verification Script
# Checks for vulnerable Ruflo MCP bridge instances
# Exit codes: 0 = PATCHED/not present, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

VULNERABLE=0
UNKNOWN=0

# Check 1: Is port 3001 listening on 0.0.0.0?
echo "[*] Checking for MCP bridge listening on 0.0.0.0:3001..."
if ss -tlnp 2>/dev/null | grep -q '0.0.0.0:3001'; then
  echo "[!] FOUND: Port 3001 bound to 0.0.0.0 (all interfaces)"
  VULNERABLE=1
elif ss -tlnp 2>/dev/null | grep -q ':3001'; then
  echo "[i] Port 3001 is listening but bound to loopback only (likely patched)"
else
  echo "[i] Port 3001 is not listening"
fi

# Check 2: Probe the /mcp endpoint for unauthenticated access
if command -v curl &>/dev/null; then
  echo "[*] Probing localhost:3001/mcp for unauthenticated tool listing..."
  RESP=$(curl -s -m 5 -X POST http://127.0.0.1:3001/mcp \
    -H 'Content-Type: application/json' \
    -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' 2>/dev/null || true)
  if echo "$RESP" | grep -q 'ruflo__terminal_execute'; then
    echo "[!] VULNERABLE: MCP bridge returned terminal_execute tool without auth"
    VULNERABLE=1
  elif echo "$RESP" | grep -q '"error"'; then
    echo "[i] MCP bridge returned error (likely patched or auth-gated)"
  elif [ -z "$RESP" ]; then
    echo "[i] No response from MCP bridge (not running or filtered)"
  fi
fi

# Check 3: Check installed ruflo/claude-flow version via npm
for PKG in ruflo claude-flow @claude-flow/cli; do
  if command -v npm &>/dev/null; then
    VER=$(npm list -g "$PKG" 2>/dev/null | grep "$PKG@" | head -1 | sed 's/.*@//' || true)
    if [ -n "$VER" ]; then
      echo "[*] Found $PKG@$VER installed globally"
      # Compare version - vulnerable if < 3.16.3
      MAJOR=$(echo "$VER" | cut -d. -f1)
      MINOR=$(echo "$VER" | cut -d. -f2)
      PATCH=$(echo "$VER" | cut -d. -f3 | cut -d- -f1)
      if [ "$MAJOR" -lt 3 ] 2>/dev/null || \
         ([ "$MAJOR" -eq 3 ] && [ "$MINOR" -lt 16 ] 2>/dev/null) || \
         ([ "$MAJOR" -eq 3 ] && [ "$MINOR" -eq 16 ] && [ "$PATCH" -lt 3 ] 2>/dev/null); then
        echo "[!] VULNERABLE: $PKG@$VER is below 3.16.3"
        VULNERABLE=1
      else
        echo "[i] PATCHED: $PKG@$VER is >= 3.16.3"
      fi
    fi
  fi
done

# Check 4: Check running Docker containers
if command -v docker &>/dev/null; then
  echo "[*] Checking running Docker containers for ruflo..."
  CONTAINERS=$(docker ps --format '{{.Names}} {{.Image}}' 2>/dev/null | grep -i ruflo || true)
  if [ -n "$CONTAINERS" ]; then
    echo "[!] Found ruflo containers running:"
    echo "$CONTAINERS"
    # Check if port 3001 is mapped to 0.0.0.0
    if docker ps --format '{{.Ports}}' 2>/dev/null | grep -q '0.0.0.0:3001'; then
      echo "[!] VULNERABLE: Container has 0.0.0.0:3001 port mapping"
      VULNERABLE=1
    fi
  else
    echo "[i] No ruflo containers found running"
  fi
fi

# Final verdict
echo ""
if [ "$VULNERABLE" -eq 1 ]; then
  echo "VULNERABLE — CVE-2026-59726 (RufRoot) exposure detected"
  exit 1
else
  echo "PATCHED — No CVE-2026-59726 exposure detected"
  exit 0
fi