Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5…

#!/usr/bin/env bash
# CVE-2026-77185 Checker — Apache MINA SSHD Async Auth Bypass
# Checks for vulnerable sshd-core JARs and AsyncAuthException usage
# Exit codes: 0=PATCHED/NOT_PRESENT, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

SEARCH_DIR="${1:-.}"
VULN_FOUND=0
ASYNC_RISK=0
JARS_FOUND=0

echo "[*] Scanning for sshd-core JARs in: $SEARCH_DIR"

while IFS= read -r -d '' jar; do
    JARS_FOUND=1
    basename_jar=$(basename "$jar")
    # Extract version from filename pattern sshd-core-X.Y.Z.jar
    version=$(echo "$basename_jar" | sed -n 's/sshd-core-\([0-9][0-9a-zA-Z.\-]*\)\.jar/\1/p')
    if [ -z "$version" ]; then
        # Try extracting from MANIFEST.MF inside JAR
        version=$(unzip -p "$jar" META-INF/MANIFEST.MF 2>/dev/null | grep -i 'Bundle-Version\|Implementation-Version' | head -1 | awk -F': ' '{print $2}' | tr -d '\r')
    fi
    if [ -z "$version" ]; then
        echo "[?] UNKNOWN — Found $jar but could not determine version"
        continue
    fi
    echo "[*] Found: $basename_jar (version: $version)"

    # Check if version is in affected range
    # Affected: 2.0.0-2.19.0, 3.0.0-M1-3.0.0-M5
    # Safe: 2.20.0+, 3.0.0-M6+, 1.x
    major=$(echo "$version" | cut -d. -f1)
    minor=$(echo "$version" | cut -d. -f2)

    if [ "$major" -eq 2 ] 2>/dev/null; then
        if [ "$minor" -ge 0 ] && [ "$minor" -le 19 ] 2>/dev/null; then
            echo "[!] VULNERABLE — $basename_jar ($version) is in affected range 2.0.0–2.19.0"
            VULN_FOUND=1
        else
            echo "[+] PATCHED — $basename_jar ($version) is >= 2.20.0"
        fi
    elif [ "$major" -eq 3 ] 2>/dev/null; then
        if echo "$version" | grep -qE '3\.0\.0-M[1-5]$'; then
            echo "[!] VULNERABLE — $basename_jar ($version) is in affected range 3.0.0-M1–M5"
            VULN_FOUND=1
        else
            echo "[+] PATCHED — $basename_jar ($version) is >= 3.0.0-M6"
        fi
    else
        echo "[+] NOT AFFECTED — $basename_jar ($version) is outside affected major versions"
    fi
done < <(find "$SEARCH_DIR" -name 'sshd-core-*.jar' -print0 2>/dev/null)

if [ "$JARS_FOUND" -eq 0 ]; then
    echo "[+] NOT PRESENT — No sshd-core JARs found in $SEARCH_DIR"
    echo "PATCHED"
    exit 0
fi

# Bonus: check for AsyncAuthException usage in source trees
echo ""
echo "[*] Checking for AsyncAuthException usage in Java sources under $SEARCH_DIR..."
if find "$SEARCH_DIR" -name '*.java' -exec grep -l 'AsyncAuthException' {} + 2>/dev/null | head -5 | grep -q .; then
    echo "[!!] WARNING — Found AsyncAuthException references in source code. Your application MAY use the vulnerable async auth path."
    ASYNC_RISK=1
else
    echo "[+] No AsyncAuthException usage found in source files — likely not using the vulnerable async auth pattern."
fi

if [ "$VULN_FOUND" -eq 1 ]; then
    if [ "$ASYNC_RISK" -eq 1 ]; then
        echo ""
        echo "VULNERABLE (async auth pattern detected — HIGH RISK)"
    else
        echo ""
        echo "VULNERABLE (but async auth pattern not detected in source — likely low practical risk)"
    fi
    exit 1
else
    echo ""
    echo "PATCHED"
    exit 0
fi