Oracle WebLogic Server Core SAML Authentication Bypass

#!/usr/bin/env bash
# check_cve_2026_60206.sh — Detect CVE-2026-60206 exposure
# Usage: bash check_cve_2026_60206.sh <MW_HOME>
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

MW_HOME="${1:-}"
if [[ -z "$MW_HOME" ]]; then
  echo "Usage: $0 <MW_HOME>"
  echo "Example: $0 /u01/app/oracle/middleware"
  exit 2
fi

REGISTRY="$MW_HOME/inventory/registry.xml"
WLS_JAR="$MW_HOME/wlserver/server/lib/weblogic.jar"
PATCH_DIR="$MW_HOME/.patch_storage"

# --- Step 1: Detect WebLogic version ---
VERSION="unknown"
if [[ -f "$WLS_JAR" ]]; then
  VERSION=$(java -cp "$WLS_JAR" weblogic.version 2>/dev/null | grep -oP '\d+\.\d+\.\d+\.\d+\.\d+' | head -1 || echo "unknown")
fi

if [[ "$VERSION" == "unknown" ]]; then
  # Fallback: check registry.xml
  if [[ -f "$REGISTRY" ]]; then
    VERSION=$(grep -oP 'version="\K[0-9.]+' "$REGISTRY" | head -1 || echo "unknown")
  fi
fi

echo "[*] WebLogic version detected: $VERSION"

# --- Step 2: Check if version is in affected range ---
AFFECTED_VERSIONS="12.2.1.4.0 14.1.1.0.0 14.1.2.0.0 15.1.1.0.0"
IS_AFFECTED=false
for v in $AFFECTED_VERSIONS; do
  if [[ "$VERSION" == *"$v"* ]]; then
    IS_AFFECTED=true
    break
  fi
done

if [[ "$IS_AFFECTED" == false ]]; then
  echo "[+] PATCHED — WebLogic version $VERSION is not in the affected range."
  exit 0
fi

echo "[!] Version $VERSION is in the affected range."

# --- Step 3: Check for July 2026 CPU PSU patches ---
FIXED_PSUS="39638312 39638182 39596645 39637038"
PATCHED=false

# Check via opatch
OPATCH="$MW_HOME/OPatch/opatch"
if [[ -x "$OPATCH" ]]; then
  INSTALLED=$($OPATCH lspatches 2>/dev/null || echo "")
  for psu in $FIXED_PSUS; do
    if echo "$INSTALLED" | grep -q "$psu"; then
      PATCHED=true
      echo "[+] Found PSU patch $psu applied."
      break
    fi
  done
else
  echo "[?] OPatch not found at $OPATCH — checking patch_storage."
  if [[ -d "$PATCH_DIR" ]]; then
    for psu in $FIXED_PSUS; do
      if ls "$PATCH_DIR" 2>/dev/null | grep -q "$psu"; then
        PATCHED=true
        echo "[+] Found PSU patch $psu in patch storage."
        break
      fi
    done
  fi
fi

if [[ "$PATCHED" == true ]]; then
  echo "[+] PATCHED — July 2026 CPU PSU is applied."
  exit 0
fi

# --- Step 4: Check SAML SSO configuration ---
echo "[!] No July 2026 CPU PSU detected. Checking SAML SSO configuration..."
SAML_CONFIGURED=false
DOMAIN_DIRS=$(find "$MW_HOME" -name "config.xml" -path "*/config/config.xml" 2>/dev/null || true)

for cfg in $DOMAIN_DIRS; do
  if grep -qiE 'saml|SAMLAuthenticator|SAMLIdentityAsserter|saml2' "$cfg" 2>/dev/null; then
    SAML_CONFIGURED=true
    echo "[!] SAML configuration found in: $cfg"
  fi
done

# Also check security realm config
for cfg in $DOMAIN_DIRS; do
  REALM_DIR=$(dirname "$cfg")/security
  if [[ -d "$REALM_DIR" ]]; then
    if grep -rqiE 'saml|SAMLAuthenticator|SAMLIdentityAsserter' "$REALM_DIR" 2>/dev/null; then
      SAML_CONFIGURED=true
      echo "[!] SAML security provider found in: $REALM_DIR"
    fi
  fi
done

if [[ "$SAML_CONFIGURED" == true ]]; then
  echo ""
  echo "============================================"
  echo "  VULNERABLE — CVE-2026-60206"
  echo "  Version: $VERSION (affected)"
  echo "  July 2026 CPU: NOT applied"
  echo "  SAML SSO: CONFIGURED (exploitable)"
  echo "============================================"
  exit 1
else
  echo ""
  echo "============================================"
  echo "  VULNERABLE (reduced risk) — CVE-2026-60206"
  echo "  Version: $VERSION (affected)"
  echo "  July 2026 CPU: NOT applied"
  echo "  SAML SSO: NOT detected (not currently exploitable)"
  echo "  ACTION: Patch anyway — SAML may be enabled later"
  echo "============================================"
  exit 1
fi