IBM i Host-Based Printer Subsystem missing authorization information disclosure

#!/usr/bin/env bash
# CVE-2026-77153 — IBM i Host-Based Printer Subsystem Missing Authorization
# Checks whether the appropriate PTF is applied on the target IBM i LPAR.
# Usage: ./check_cve_2026_77153.sh <hostname> [ssh_user]
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -uo pipefail

HOST="${1:?Usage: $0 <ibmi_hostname> [ssh_user]}"
USER="${2:-qsecofr}"
TIMEOUT=15

# PTFs that fix CVE-2026-77153 by release
PTFS="SJ11522 SJ11524 SJ11523 SJ11502"
PTF_CSV=$(echo "$PTFS" | sed "s/ /','/g" | sed "s/^/'/" | sed "s/$/'/")

echo "[*] CVE-2026-77153 checker — target: ${USER}@${HOST}"
echo "[*] Querying QSYS2.PTF_INFO for PTFs: ${PTFS}"

# Use SQL services via QSH db2 utility over SSH
SQL="SELECT PTF_IDENTIFIER, PTF_IPL_ACTION, PTF_LOADED_STATUS, PTF_PRODUCT_ID FROM QSYS2.PTF_INFO WHERE PTF_IDENTIFIER IN (${PTF_CSV}) AND PTF_PRODUCT_ID = '5770SS1' AND PTF_LOADED_STATUS IN ('APPLIED','PERMANENTLY APPLIED','TEMPORARILY APPLIED')"

RESULT=$(ssh -o ConnectTimeout="${TIMEOUT}" -o StrictHostKeyChecking=accept-new \
  "${USER}@${HOST}" \
  "db2 \"${SQL}\"" 2>&1) || {
  RC=$?
  echo "[!] SSH or db2 command failed (rc=${RC})."
  echo "[*] Fallback: trying CL DSPPTF commands..."
  FOUND=0
  for PTF in ${PTFS}; do
    CL_OUT=$(ssh -o ConnectTimeout="${TIMEOUT}" "${USER}@${HOST}" \
      "system \"DSPPTF LICPGM(5770SS1) SELECT(${PTF})\"" 2>&1) || true
    if echo "${CL_OUT}" | grep -qiE 'temporarily applied|permanently applied'; then
      echo "[+] PATCHED — PTF ${PTF} is applied on ${HOST}."
      FOUND=1
      break
    fi
  done
  if [ "${FOUND}" -eq 0 ]; then
    if echo "${CL_OUT}" | grep -qiE 'not found|CPF0'; then
      echo "[-] VULNERABLE — No CVE-2026-77153 PTF detected on ${HOST}."
      exit 1
    else
      echo "[?] UNKNOWN — Could not determine PTF status on ${HOST}."
      echo "    Manual check: DSPPTF LICPGM(5770SS1) SELECT(SJ11502)"
      exit 2
    fi
  fi
  exit 0
}

# Parse SQL result
if echo "${RESULT}" | grep -qiE 'SJ11522|SJ11524|SJ11523|SJ11502'; then
  echo "[+] PATCHED — CVE-2026-77153 PTF found and applied:"
  echo "${RESULT}" | grep -iE 'SJ[0-9]+'
  exit 0
elif echo "${RESULT}" | grep -qi 'no rows'; then
  echo "[-] VULNERABLE — No CVE-2026-77153 PTF is applied on ${HOST}."
  echo "    Required PTFs: SJ11522 (7.3), SJ11524 (7.4), SJ11523 (7.5), SJ11502 (7.6)"
  exit 1
else
  echo "[?] UNKNOWN — Unexpected output from PTF query."
  echo "${RESULT}"
  echo "    Manual check: DSPPTF LICPGM(5770SS1) SELECT(SJ11502)"
  exit 2
fi