Zimbra Collaboration Suite SNMP Notification OS Command Injection

#!/usr/bin/env bash
# CVE-2026-73570 Vulnerability Check
# Checks for: zimbra-snmp package, SNMP notification config, ZCS version
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

FIXED_MAJOR=10
FIXED_MINOR=1
FIXED_PATCH=20

echo "=== CVE-2026-73570 Check ==="
echo ""

# Check if Zimbra is installed
if [ ! -d /opt/zimbra ]; then
  echo "[INFO] Zimbra not found at /opt/zimbra"
  echo "UNKNOWN"
  exit 2
fi

# Get ZCS version
VERSION_FILE="/opt/zimbra/conf/.version"
if [ -f "$VERSION_FILE" ]; then
  ZCS_VERSION=$(grep -oP '\d+\.\d+\.\d+' "$VERSION_FILE" | head -1)
elif command -v zmcontrol &>/dev/null; then
  ZCS_VERSION=$(su - zimbra -c 'zmcontrol -v' 2>/dev/null | grep -oP '\d+\.\d+\.\d+' | head -1)
else
  ZCS_VERSION=""
fi

if [ -z "$ZCS_VERSION" ]; then
  echo "[WARN] Could not determine ZCS version"
  echo "UNKNOWN"
  exit 2
fi

echo "[INFO] ZCS version: $ZCS_VERSION"

# Parse version components
IFS='.' read -r V_MAJOR V_MINOR V_PATCH <<< "$ZCS_VERSION"

# Check if zimbra-snmp package is installed
SNMP_INSTALLED=false
if command -v dpkg &>/dev/null && dpkg -l zimbra-snmp 2>/dev/null | grep -q '^ii'; then
  SNMP_INSTALLED=true
elif command -v rpm &>/dev/null && rpm -q zimbra-snmp &>/dev/null; then
  SNMP_INSTALLED=true
elif [ -f /opt/zimbra/bin/zmswatchctl ]; then
  SNMP_INSTALLED=true
fi

echo "[INFO] zimbra-snmp installed: $SNMP_INSTALLED"

# Check if SNMP notifications are enabled
SNMP_ENABLED=false
if [ -f /opt/zimbra/conf/swatchrc ] || [ -f /opt/zimbra/conf/swatchrc.in ]; then
  if su - zimbra -c 'zmlocalconfig -q zimbra_snmp_enabled' 2>/dev/null | grep -qi 'true'; then
    SNMP_ENABLED=true
  fi
  # Also check if swatchdog is running
  if pgrep -f swatchdog &>/dev/null; then
    SNMP_ENABLED=true
  fi
fi

echo "[INFO] SNMP notifications enabled: $SNMP_ENABLED"

# Version comparison
VERSION_PATCHED=false
if [ "$V_MAJOR" -gt "$FIXED_MAJOR" ] 2>/dev/null; then
  VERSION_PATCHED=true
elif [ "$V_MAJOR" -eq "$FIXED_MAJOR" ] && [ "$V_MINOR" -gt "$FIXED_MINOR" ] 2>/dev/null; then
  VERSION_PATCHED=true
elif [ "$V_MAJOR" -eq "$FIXED_MAJOR" ] && [ "$V_MINOR" -eq "$FIXED_MINOR" ] && [ "$V_PATCH" -ge "$FIXED_PATCH" ] 2>/dev/null; then
  VERSION_PATCHED=true
fi

echo "[INFO] Version patched (>= 10.1.20): $VERSION_PATCHED"
echo ""

# Determine result
if $VERSION_PATCHED; then
  echo "PATCHED"
  exit 0
fi

if $SNMP_INSTALLED; then
  if $SNMP_ENABLED; then
    echo "[ALERT] zimbra-snmp is installed AND SNMP notifications are enabled on an unpatched version."
    echo "VULNERABLE"
    exit 1
  else
    echo "[WARN] zimbra-snmp is installed but SNMP notifications appear disabled. Exploitability is conditional."
    echo "VULNERABLE"
    exit 1
  fi
else
  echo "[INFO] zimbra-snmp is NOT installed. This instance is not exploitable via CVE-2026-73570."
  echo "PATCHED"
  exit 0
fi