CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14

# check-cve-2026-7312.ps1

# Verifies likely exposure to CVE-2026-7312 on a Sitefinity web root.

# Output: VULNERABLE / PATCHED / UNKNOWN

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


param(
    [Parameter(Mandatory=$true)]
    [string]$WebRoot
)

$ErrorActionPreference = 'Stop'

function Write-Result {
    param(
        [string]$Status,
        [string]$Message,
        [int]$Code
    )
    Write-Output ("{0}: {1}" -f $Status, $Message)
    exit $Code
}

function Parse-Version {
    param([string]$s)
    try { return [version]$s } catch { return $null }
}

function In-Range {
    param(
        [version]$v,
        [version]$min,
        [version]$maxExclusive
    )
    return ($v -ge $min -and $v -lt $maxExclusive)
}

if (-not (Test-Path -LiteralPath $WebRoot)) {
    Write-Result -Status 'UNKNOWN' -Message "Web root not found: $WebRoot" -Code 2
}

# Sitefinity projects are statically compiled and keep references in the bin folder.

# We use Telerik.Sitefinity.dll file version as the runtime Sitefinity version signal.

$dll = Get-ChildItem -LiteralPath $WebRoot -Recurse -File -Filter 'Telerik.Sitefinity.dll' |
       Sort-Object FullName |
       Select-Object -First 1

if (-not $dll) {
    Write-Result -Status 'UNKNOWN' -Message 'Telerik.Sitefinity.dll not found under the supplied web root.' -Code 2
}

$fileVersion = $dll.VersionInfo.FileVersion
if (-not $fileVersion) {
    Write-Result -Status 'UNKNOWN' -Message "Could not read file version from $($dll.FullName)" -Code 2
}

$v = Parse-Version $fileVersion
if (-not $v) {
    Write-Result -Status 'UNKNOWN' -Message "Unparseable Sitefinity version: $fileVersion" -Code 2
}

# Fixed builds inferred from Progress May 2026 package releases.

$affected = $false
$branch = $null

if (In-Range -v $v -min ([version]'14.0.7700.0') -maxExclusive ([version]'14.4.8152.0')) { $affected = $true; $branch = '14.0-14.4' }
elseif (In-Range -v $v -min ([version]'15.0.8200.0') -maxExclusive ([version]'15.0.8234.0')) { $affected = $true; $branch = '15.0' }
elseif (In-Range -v $v -min ([version]'15.1.8300.0') -maxExclusive ([version]'15.1.8335.0')) { $affected = $true; $branch = '15.1' }
elseif (In-Range -v $v -min ([version]'15.2.8400.0') -maxExclusive ([version]'15.2.8441.0')) { $affected = $true; $branch = '15.2' }
elseif (In-Range -v $v -min ([version]'15.3.8500.0') -maxExclusive ([version]'15.3.8531.0')) { $affected = $true; $branch = '15.3' }
elseif (In-Range -v $v -min ([version]'15.4.8600.0') -maxExclusive ([version]'15.4.8630.0')) { $affected = $true; $branch = '15.4' }

if (-not $affected) {
    Write-Result -Status 'PATCHED' -Message "Sitefinity version $fileVersion is outside the known vulnerable ranges for CVE-2026-7312." -Code 0
}

# Check for signs of active Insight integration. This CVE requires Insight + non-default config.

$insightDll = Get-ChildItem -LiteralPath $WebRoot -Recurse -File -ErrorAction SilentlyContinue |
              Where-Object { $_.Name -match 'DigitalExperienceCloudConnector|Insight' } |
              Select-Object -First 5

$configHits = @()
$configFiles = Get-ChildItem -LiteralPath $WebRoot -Recurse -File -Include *.config,*.json,*.xml -ErrorAction SilentlyContinue
foreach ($f in $configFiles) {
    try {
        $matches = Select-String -LiteralPath $f.FullName -Pattern 'insight\.sitefinity\.com|Sitefinity Insight|DigitalExperienceCloud|Progress\.Sitefinity\.Insight|apiKey|accessKey' -SimpleMatch:$false -ErrorAction Stop
        if ($matches) { $configHits += $matches | Select-Object -First 3 }
    } catch {
        # Ignore unreadable/binary-ish files

    }
    if ($configHits.Count -ge 3) { break }
}

$hasInsightEvidence = ($insightDll.Count -gt 0 -or $configHits.Count -gt 0)

if ($hasInsightEvidence) {
    $evidence = @()
    if ($insightDll.Count -gt 0) { $evidence += ('connector DLLs: ' + (($insightDll | ForEach-Object { $_.Name }) -join ', ')) }
    if ($configHits.Count -gt 0) { $evidence += ('config references in: ' + (($configHits | ForEach-Object { $_.Path } | Select-Object -Unique) -join ', ')) }
    Write-Result -Status 'VULNERABLE' -Message ("Sitefinity version $fileVersion ($branch) is in a vulnerable range and Insight integration evidence was found; " + ($evidence -join '; ')) -Code 1
}

Write-Result -Status 'UNKNOWN' -Message "Sitefinity version $fileVersion is in a vulnerable range, but no clear local evidence of active Insight integration was found. CVE-2026-7312 requires active Insight integration and non-default configuration; verify connector usage manually." -Code 2