Jenkins Remoting JEP-200 Deserialization Filter Bypass via Fallback Class Resolution

#!/usr/bin/env bash
# CVE-2026-70426 Checker — Jenkins Remoting JEP-200 Deserialization Filter Bypass
# Usage: bash check_cve_2026_70426.sh /var/lib/jenkins
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

JENKINS_HOME="${1:-/var/lib/jenkins}"
RESULT="UNKNOWN"

# Try to read Jenkins version from identity.xml or config
get_jenkins_version() {
  local id_file="$JENKINS_HOME/config.xml"
  if [ -f "$JENKINS_HOME/identity.xml.bak" ] || [ -f "$id_file" ]; then
    # Check war manifest
    local war_paths=("/usr/share/java/jenkins.war" "/usr/lib/jenkins/jenkins.war" "$JENKINS_HOME/jenkins.war")
    for wp in "${war_paths[@]}"; do
      if [ -f "$wp" ]; then
        unzip -p "$wp" META-INF/MANIFEST.MF 2>/dev/null | grep -i 'Jenkins-Version' | awk -F': ' '{print $2}' | tr -d '\r'
        return
      fi
    done
  fi
  # Fallback: check via CLI or HTTP
  if command -v jenkins-cli &>/dev/null; then
    jenkins-cli version 2>/dev/null
    return
  fi
  # Fallback: parse from update center metadata
  if [ -f "$JENKINS_HOME/updates/default.json" ]; then
    python3 -c "import json,sys; d=json.load(open('$JENKINS_HOME/updates/default.json')); print(d.get('core',{}).get('version',''))" 2>/dev/null
    return
  fi
  echo ""
}

# Check Remoting version from the jar
get_remoting_version() {
  local remoting_jar="$JENKINS_HOME/war/WEB-INF/lib/remoting-*.jar"
  # Expand glob
  for jar in $remoting_jar; do
    if [ -f "$jar" ]; then
      unzip -p "$jar" META-INF/MANIFEST.MF 2>/dev/null | grep -i 'Implementation-Version\|Bundle-Version' | head -1 | awk -F': ' '{print $2}' | tr -d '\r'
      return
    fi
  done
  # Try extracted war directory
  local war_paths=("/usr/share/java/jenkins.war" "/usr/lib/jenkins/jenkins.war")
  for wp in "${war_paths[@]}"; do
    if [ -f "$wp" ]; then
      unzip -l "$wp" 2>/dev/null | grep 'remoting-' | awk '{print $NF}' | sed 's/.*remoting-//;s/\.jar//'
      return
    fi
  done
  echo ""
}

# Version comparison: returns 0 if $1 >= $2
version_gte() {
  [ "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" = "$2" ]
}

echo "=== CVE-2026-70426 Check ==="
echo "Jenkins Home: $JENKINS_HOME"

JENKINS_VER=$(get_jenkins_version)
REMOTING_VER=$(get_remoting_version)

echo "Jenkins Version: ${JENKINS_VER:-not detected}"
echo "Remoting Version: ${REMOTING_VER:-not detected}"

# Check for workaround plugin
WORKAROUND_INSTALLED=false
if [ -d "$JENKINS_HOME/plugins" ]; then
  if ls "$JENKINS_HOME/plugins/" 2>/dev/null | grep -qi 'SECURITY-3911\|security-3911'; then
    WORKAROUND_INSTALLED=true
    echo "Workaround plugin: INSTALLED"
  fi
fi

if [ -z "$JENKINS_VER" ] && [ -z "$REMOTING_VER" ]; then
  echo "Result: UNKNOWN — could not determine Jenkins or Remoting version."
  echo "Verify manually: Manage Jenkins > About Jenkins, or check /api/json on the controller."
  exit 2
fi

# Fixed versions: Jenkins 2.576+, LTS 2.568.2+
# Remoting fixed: 3385+ (or the exception 3355.3357.v931d3c992987)
if [ -n "$JENKINS_VER" ]; then
  # Check if it's an LTS version (x.y.z format)
  if echo "$JENKINS_VER" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+'; then
    # LTS — fixed in 2.568.2
    if version_gte "$JENKINS_VER" "2.568.2"; then
      RESULT="PATCHED"
    else
      RESULT="VULNERABLE"
    fi
  else
    # Weekly — fixed in 2.576
    if version_gte "$JENKINS_VER" "2.576"; then
      RESULT="PATCHED"
    else
      RESULT="VULNERABLE"
    fi
  fi
fi

# Override if workaround plugin is installed
if [ "$WORKAROUND_INSTALLED" = true ] && [ "$RESULT" = "VULNERABLE" ]; then
  RESULT="PATCHED"
  echo "Note: Workaround plugin detected — fallback path is mitigated."
fi

echo "Result: $RESULT"
case "$RESULT" in
  PATCHED)    exit 0 ;;
  VULNERABLE) exit 1 ;;
  *)          exit 2 ;;
esac