DeepSeek Harness Authentication Bypass via Host Header Spoofing

#!/usr/bin/env bash
# CVE-2026-82533 — DeepSeek Harness auth-bypass version checker
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN
set -uo pipefail

FIXED="0.1.2-alpha.1"
VER=""

# --- Locate installed dsh version ---
if command -v dsh &>/dev/null; then
  VER=$(dsh --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+[-a-zA-Z0-9.]*' | head -1)
fi

if [ -z "$VER" ] && command -v node &>/dev/null; then
  for base in "$(npm root -g 2>/dev/null)" "$(npm root 2>/dev/null)"; do
    [ -z "$base" ] && continue
    pj="${base}/@deepseek-ai/dsh/package.json"
    if [ -f "$pj" ]; then
      VER=$(node -p "require('${pj}').version" 2>/dev/null)
      [ -n "$VER" ] && break
    fi
  done
fi

if [ -z "$VER" ]; then
  echo "UNKNOWN - DeepSeek Harness (dsh) not found on this host"
  exit 2
fi

echo "[*] Detected dsh version: $VER"

# --- Semver comparison via node (guaranteed present if dsh is installed) ---
RESULT=$(node -e "
  function cmp(a, b) {
    var pa = a.split('-'), pb = b.split('-');
    var ca = pa[0].split('.').map(Number), cb = pb[0].split('.').map(Number);
    for (var i = 0; i < 3; i++) {
      if (ca[i] !== cb[i]) return ca[i] - cb[i];
    }
    var ra = pa[1] || '~', rb = pb[1] || '~';
    if (ra === '~' && rb === '~') return 0;
    if (ra === '~') return 1;  // no prerelease > prerelease
    if (rb === '~') return -1;
    return ra < rb ? -1 : ra > rb ? 1 : 0;
  }
  console.log(cmp('${VER}', '${FIXED}') >= 0 ? 'PATCHED' : 'VULNERABLE');
" 2>/dev/null || echo "UNKNOWN")

# --- Check for non-loopback exposure of port 3080 ---
if command -v ss &>/dev/null; then
  EXPOSED=$(ss -tln 2>/dev/null | awk '/:3080 /{print}' | grep -v '127\.0\.0\.1' | grep -v '\[::1\]' || true)
  if [ -n "$EXPOSED" ]; then
    echo "[!] WARNING: port 3080 bound to non-loopback address — remotely exploitable!"
    echo "    $EXPOSED"
  fi
elif command -v netstat &>/dev/null; then
  EXPOSED=$(netstat -tln 2>/dev/null | awk '/:3080 /{print}' | grep -v '127\.0\.0\.1' | grep -v '::1' || true)
  if [ -n "$EXPOSED" ]; then
    echo "[!] WARNING: port 3080 bound to non-loopback address — remotely exploitable!"
    echo "    $EXPOSED"
  fi
fi

echo "$RESULT - dsh $VER (fixed in >= $FIXED)"
case "$RESULT" in
  PATCHED)    exit 0 ;;
  VULNERABLE) exit 1 ;;
  *)          exit 2 ;;
esac