HCL BigFix Service Management V23 SQL Injection and Cross-Tenant Data Exposure

#!/usr/bin/env bash
# check_cve_2026_67100.sh — Detect CVE-2026-67100 in HCL BigFix Service Management
# Usage: bash check_cve_2026_67100.sh [SM_BASE_URL]
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

SM_URL="${1:-}"
RESULT="UNKNOWN"

# Method 1: Check version via SM API/about endpoint
if [[ -n "$SM_URL" ]]; then
  echo "[*] Checking BigFix SM version at $SM_URL ..."
  VERSION=$(curl -sk --max-time 10 "${SM_URL}/api/v1/version" 2>/dev/null \
    | grep -oP '"version"\s*:\s*"\K[^"]+' || true)
  if [[ -z "$VERSION" ]]; then
    VERSION=$(curl -sk --max-time 10 "${SM_URL}/about" 2>/dev/null \
      | grep -ioP 'version[:\s]+\K[0-9]+\.[0-9]+\.[0-9]+[^\s<"]*' | head -1 || true)
  fi
  if [[ -n "$VERSION" ]]; then
    echo "[*] Detected version: $VERSION"
    # HCL has not published exact fixed sub-version; flag all V23.x as potentially vulnerable
    if echo "$VERSION" | grep -qP '^23\.'; then
      echo "[!] Version $VERSION is in the affected V23 range."
      echo "[!] Check HCL KB0133782 to confirm if your exact build includes the fix."
      RESULT="VULNERABLE"
    else
      echo "[+] Version $VERSION does not appear to be in the affected V23 range."
      RESULT="PATCHED"
    fi
  else
    echo "[?] Could not retrieve version from $SM_URL. Trying local file check..."
  fi
fi

# Method 2: Local file version check (run on SM app server)
if [[ "$RESULT" == "UNKNOWN" ]]; then
  INSTALL_DIRS=("/opt/hcl/bigfix-sm" "/opt/BigFix/SM" "/usr/local/bigfix-sm")
  for DIR in "${INSTALL_DIRS[@]}"; do
    if [[ -d "$DIR" ]]; then
      echo "[*] Found installation at $DIR"
      VERFILE=$(find "$DIR" -maxdepth 3 -name 'version*.properties' -o -name 'build.info' 2>/dev/null | head -1)
      if [[ -n "$VERFILE" ]]; then
        echo "[*] Version file: $VERFILE"
        cat "$VERFILE"
        if grep -qiP '23\.' "$VERFILE"; then
          RESULT="VULNERABLE"
          echo "[!] VULNERABLE — V23 detected. Verify patch status against KB0133782."
        else
          RESULT="PATCHED"
          echo "[+] PATCHED — version outside affected range."
        fi
      fi
      break
    fi
  done
fi

if [[ "$RESULT" == "UNKNOWN" ]]; then
  echo "[?] UNKNOWN — Could not determine BigFix SM version."
  echo "    Manually verify against HCL KB0133782."
  exit 2
elif [[ "$RESULT" == "VULNERABLE" ]]; then
  echo "VULNERABLE"
  exit 1
else
  echo "PATCHED"
  exit 0
fi