Rejetto HFS Predictable PRNG Session-Cookie Signing Key Leading to Unauthenticated RCE

#!/usr/bin/env bash
# check_hfs_cve_2026_61500.sh — Detect CVE-2026-61500 (Rejetto HFS PRNG session forgery)
# Usage: bash check_hfs_cve_2026_61500.sh <host:port>
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <host:port>"
  echo "Example: $0 192.168.1.50:8080"
  exit 2
fi

TARGET="$1"
BASE_URL="http://${TARGET}"

echo "[*] Checking HFS instance at ${BASE_URL} for CVE-2026-61500..."

# Step 1: Confirm it's HFS and get version
VERSION_RAW=$(curl -sS --max-time 10 "${BASE_URL}/~/api/get_status" 2>/dev/null || true)

if [ -z "$VERSION_RAW" ]; then
  # Try alternative endpoint
  VERSION_RAW=$(curl -sS --max-time 10 -o /dev/null -w '%{http_code}' "${BASE_URL}/" -D - 2>/dev/null || true)
  if echo "$VERSION_RAW" | grep -qi 'HFS'; then
    echo "[*] HFS detected via headers, but could not determine version."
  else
    echo "[!] Target does not appear to be a Rejetto HFS instance."
    echo "UNKNOWN"
    exit 2
  fi
fi

# Try to extract version from API response
VERSION=$(echo "$VERSION_RAW" | grep -oP '"version"\s*:\s*"\K[0-9]+\.[0-9]+\.[0-9]+' 2>/dev/null || true)

if [ -z "$VERSION" ]; then
  # Try extracting from HTML title or body
  HTML=$(curl -sS --max-time 10 "${BASE_URL}/" 2>/dev/null || true)
  VERSION=$(echo "$HTML" | grep -oP 'HFS\s+\K[0-9]+\.[0-9]+\.[0-9]+' 2>/dev/null || true)
fi

if [ -z "$VERSION" ]; then
  echo "[!] Could not determine HFS version. Manual verification needed."
  echo "UNKNOWN"
  exit 2
fi

echo "[*] Detected HFS version: ${VERSION}"

# Step 2: Parse version components
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

# Step 3: Check if version is in vulnerable range (3.0.0 - 3.2.0)
if [ "$MAJOR" -eq 3 ]; then
  if [ "$MINOR" -lt 0 ]; then
    echo "[*] Version ${VERSION} is below affected range."
    echo "PATCHED"
    exit 1
  elif [ "$MINOR" -eq 0 ] || [ "$MINOR" -eq 1 ]; then
    echo "[!] Version ${VERSION} is in the vulnerable range (3.0.0 - 3.2.0)."
    echo "VULNERABLE"
    exit 0
  elif [ "$MINOR" -eq 2 ] && [ "$PATCH" -eq 0 ]; then
    echo "[!] Version ${VERSION} is in the vulnerable range (3.0.0 - 3.2.0)."
    echo "VULNERABLE"
    exit 0
  elif [ "$MINOR" -eq 2 ] && [ "$PATCH" -ge 1 ]; then
    echo "[+] Version ${VERSION} is patched (>= 3.2.1)."
    echo "PATCHED"
    exit 1
  elif [ "$MINOR" -gt 2 ]; then
    echo "[+] Version ${VERSION} is patched (> 3.2.x)."
    echo "PATCHED"
    exit 1
  fi
elif [ "$MAJOR" -lt 3 ]; then
  echo "[*] HFS 2.x detected — not affected by CVE-2026-61500 (but check CVE-2024-23692)."
  echo "PATCHED"
  exit 1
else
  echo "[+] Version ${VERSION} is above affected range."
  echo "PATCHED"
  exit 1
fi

echo "UNKNOWN"
exit 2