Microsoft SharePoint Server Business Connectivity Services Unsafe .NET Type Instantiation Remote Code Execution

#Requires -RunAsAdministrator
<#
  Check-CVE-2026-63520.ps1
  Checks whether the local SharePoint Server is patched against CVE-2026-63520
  (Business Connectivity Services unsafe .NET type instantiation)
  and CVE-2026-55040 (JWT authentication bypass).

  Exit codes:
    0 = PATCHED
    1 = VULNERABLE
    2 = UNKNOWN (SharePoint not detected or version unreadable)
#>

$ErrorActionPreference = 'Stop'

try {
    # Load SharePoint snap-in if available
    if (-not (Get-PSSnapin -Name Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue)) {
        Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue
    }

    # Try to get build from SharePoint farm
    $farm = $null
    try { $farm = [Microsoft.SharePoint.Administration.SPFarm]::Local } catch {}

    $buildVersion = $null
    if ($farm) {
        $buildVersion = $farm.BuildVersion
    } else {
        # Fallback: read from registry
        $regPath = 'HKLM:\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\16.0'
        if (Test-Path $regPath) {
            $ver = (Get-ItemProperty $regPath -ErrorAction SilentlyContinue).Version
            if ($ver) { $buildVersion = [System.Version]$ver }
        }
    }

    if (-not $buildVersion) {
        Write-Host 'UNKNOWN - SharePoint Server not detected on this host.'
        exit 2
    }

    $v = [System.Version]$buildVersion
    Write-Host "Detected SharePoint build: $v"

    # Patched versions (August 2026 CU - CVE-2026-63520 fix)
    # Subscription Edition: 16.0.19725.20522
    # Server 2019:          16.0.10417.20198
    # Server 2016:          16.0.5565.1001

    $vulnerable = $false
    $product = 'Unknown'

    if ($v.Build -ge 17000) {
        # Subscription Edition (builds 17xxx+)
        $product = 'SharePoint Server Subscription Edition'
        $patchedAug = [System.Version]'16.0.19725.20522'
        if ($v -lt $patchedAug) { $vulnerable = $true }
    } elseif ($v.Build -ge 10000 -and $v.Build -lt 17000) {
        # Server 2019 (builds 10xxx)
        $product = 'SharePoint Server 2019'
        $patchedAug = [System.Version]'16.0.10417.20198'
        if ($v -lt $patchedAug) { $vulnerable = $true }
    } elseif ($v.Build -ge 4000 -and $v.Build -lt 10000) {
        # Server 2016 (builds 4xxx-5xxx)
        $product = 'SharePoint Server 2016'
        $patchedAug = [System.Version]'16.0.5565.1001'
        if ($v -lt $patchedAug) { $vulnerable = $true }
    } else {
        Write-Host "UNKNOWN - Unrecognized SharePoint build range: $v"
        exit 2
    }

    Write-Host "Product: $product"

    # Also check for CVE-2026-55040 (July 2026 patch) - chain prerequisite
    # If July patch is applied, the unauthenticated chain is broken
    $julyPatchApplied = $false
    $julyCU = switch -Wildcard ($product) {
        '*Subscription*' { [System.Version]'16.0.19527.20268' }
        '*2019*'         { [System.Version]'16.0.10416.20066' }
        '*2016*'         { [System.Version]'16.0.5563.1000' }
    }
    if ($v -ge $julyCU) { $julyPatchApplied = $true }

    if ($vulnerable) {
        Write-Host ''
        Write-Host '*** VULNERABLE to CVE-2026-63520 (BCS deserialization RCE) ***' -ForegroundColor Red
        if (-not $julyPatchApplied) {
            Write-Host '*** ALSO VULNERABLE to CVE-2026-55040 (JWT auth bypass) ***' -ForegroundColor Red
            Write-Host '*** FULL UNAUTHENTICATED RCE CHAIN IS EXPLOITABLE ***' -ForegroundColor Red
            Write-Host 'PRIORITY: CRITICAL - Patch IMMEDIATELY.' -ForegroundColor Red
        } else {
            Write-Host 'CVE-2026-55040 (JWT bypass) appears patched - unauthenticated chain is mitigated.' -ForegroundColor Yellow
            Write-Host 'Authenticated RCE via BCS remains possible. Apply August CU.' -ForegroundColor Yellow
        }
        Write-Host 'VULNERABLE'
        exit 1
    } else {
        Write-Host ''
        Write-Host 'PATCHED - August 2026 CU applied. CVE-2026-63520 is remediated.' -ForegroundColor Green
        Write-Host 'PATCHED'
        exit 0
    }
} catch {
    Write-Host "UNKNOWN - Error during check: $_"
    exit 2
}