Acronis Backup cPanel/Plesk/DirectAdmin plugin local privilege escalation via insecure default file permissions

#!/usr/bin/env bash
# check_cve_2026_87886.sh — Detect CVE-2026-87886 (Acronis Backup plugin LPE)
# Run as root on cPanel/WHM, Plesk, or DirectAdmin Linux servers.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

VULNERABLE=0
CHECKED=0

version_lt() {
  # Returns 0 if $1 < $2 (using sort -V)
  [ "$(printf '%s\n%s' "$1" "$2" | sort -V | head -n1)" = "$1" ] && [ "$1" != "$2" ]
}

# --- cPanel & WHM plugin check ---
CPANEL_PLUGIN_INFO=""
if [ -d "/usr/local/cpanel" ] || command -v whmapi1 &>/dev/null; then
  # Try common Acronis plugin locations
  for candidate in \
    /usr/local/cpanel/3rdparty/acronis/version \
    /opt/acronis/cpanel/version \
    /usr/lib/acronis/cpanel/version \
    /var/cpanel/acronis/version; do
    if [ -f "$candidate" ]; then
      CPANEL_PLUGIN_INFO=$(cat "$candidate" 2>/dev/null || true)
      break
    fi
  done
  # Fallback: check RPM/dpkg
  if [ -z "$CPANEL_PLUGIN_INFO" ]; then
    CPANEL_PLUGIN_INFO=$(rpm -q --queryformat '%{VERSION}' acronis-backup-cpanel 2>/dev/null || \
                         dpkg-query -W -f='${Version}' acronis-backup-cpanel 2>/dev/null || true)
  fi
  # Fallback: check plugin metadata
  if [ -z "$CPANEL_PLUGIN_INFO" ]; then
    for meta in /var/cpanel/plugins/acronis*/version /usr/local/cpanel/whostmgr/docroot/cgi/acronis/version; do
      if [ -f "$meta" ]; then
        CPANEL_PLUGIN_INFO=$(cat "$meta" 2>/dev/null || true)
        break
      fi
    done
  fi
  if [ -n "$CPANEL_PLUGIN_INFO" ]; then
    CHECKED=1
    FIXED_CPANEL="1.9.3.1021"
    echo "[*] cPanel/WHM Acronis plugin detected: build $CPANEL_PLUGIN_INFO"
    if version_lt "$CPANEL_PLUGIN_INFO" "$FIXED_CPANEL"; then
      echo "[!] VULNERABLE — build $CPANEL_PLUGIN_INFO is below fixed build $FIXED_CPANEL"
      VULNERABLE=1
    else
      echo "[+] PATCHED — build $CPANEL_PLUGIN_INFO >= $FIXED_CPANEL"
    fi
  elif [ -d "/usr/local/cpanel" ]; then
    echo "[*] cPanel detected but Acronis Backup plugin not found — NOT AFFECTED"
    CHECKED=1
  fi
fi

# --- Plesk plugin check ---
PLESK_PLUGIN_INFO=""
if [ -d "/usr/local/psa" ] || command -v plesk &>/dev/null; then
  for candidate in \
    /opt/acronis/plesk/version \
    /usr/lib/acronis/plesk/version \
    /usr/local/psa/admin/plib/modules/acronis-backup/version; do
    if [ -f "$candidate" ]; then
      PLESK_PLUGIN_INFO=$(cat "$candidate" 2>/dev/null || true)
      break
    fi
  done
  if [ -z "$PLESK_PLUGIN_INFO" ]; then
    PLESK_PLUGIN_INFO=$(rpm -q --queryformat '%{VERSION}' acronis-backup-plesk 2>/dev/null || \
                        dpkg-query -W -f='${Version}' acronis-backup-plesk 2>/dev/null || true)
  fi
  if [ -n "$PLESK_PLUGIN_INFO" ]; then
    CHECKED=1
    FIXED_PLESK="1.8.11.638"
    echo "[*] Plesk Acronis extension detected: build $PLESK_PLUGIN_INFO"
    if version_lt "$PLESK_PLUGIN_INFO" "$FIXED_PLESK"; then
      echo "[!] VULNERABLE — build $PLESK_PLUGIN_INFO is below fixed build $FIXED_PLESK"
      VULNERABLE=1
    else
      echo "[+] PATCHED — build $PLESK_PLUGIN_INFO >= $FIXED_PLESK"
    fi
  elif [ -d "/usr/local/psa" ]; then
    echo "[*] Plesk detected but Acronis Backup extension not found — NOT AFFECTED"
    CHECKED=1
  fi
fi

# --- DirectAdmin plugin check ---
DA_PLUGIN_INFO=""
if [ -d "/usr/local/directadmin" ] || command -v directadmin &>/dev/null; then
  for candidate in \
    /opt/acronis/directadmin/version \
    /usr/lib/acronis/directadmin/version \
    /usr/local/directadmin/plugins/acronis-backup/version; do
    if [ -f "$candidate" ]; then
      DA_PLUGIN_INFO=$(cat "$candidate" 2>/dev/null || true)
      break
    fi
  done
  if [ -z "$DA_PLUGIN_INFO" ]; then
    DA_PLUGIN_INFO=$(rpm -q --queryformat '%{VERSION}' acronis-backup-directadmin 2>/dev/null || \
                     dpkg-query -W -f='${Version}' acronis-backup-directadmin 2>/dev/null || true)
  fi
  if [ -n "$DA_PLUGIN_INFO" ]; then
    CHECKED=1
    FIXED_DA="1.2.3.238"
    echo "[*] DirectAdmin Acronis plugin detected: build $DA_PLUGIN_INFO"
    if version_lt "$DA_PLUGIN_INFO" "$FIXED_DA"; then
      echo "[!] VULNERABLE — build $DA_PLUGIN_INFO is below fixed build $FIXED_DA"
      VULNERABLE=1
    else
      echo "[+] PATCHED — build $DA_PLUGIN_INFO >= $FIXED_DA"
    fi
  elif [ -d "/usr/local/directadmin" ]; then
    echo "[*] DirectAdmin detected but Acronis Backup plugin not found — NOT AFFECTED"
    CHECKED=1
  fi
fi

# --- Also check for world-writable Acronis files (detection heuristic) ---
echo ""
echo "[*] Scanning for world-writable Acronis-owned files (CWE-276 indicator)..."
WW_FILES=$(find /opt/acronis /usr/lib/acronis /usr/local/cpanel/3rdparty/acronis \
  /usr/local/psa/admin/plib/modules/acronis-backup \
  /usr/local/directadmin/plugins/acronis-backup \
  -type f -perm /o+w 2>/dev/null | head -20 || true)
if [ -n "$WW_FILES" ]; then
  echo "[!] WARNING: World-writable files found in Acronis paths:"
  echo "$WW_FILES"
  VULNERABLE=1
else
  echo "[+] No world-writable Acronis files detected."
fi

# --- Final verdict ---
echo ""
if [ "$CHECKED" -eq 0 ]; then
  echo "UNKNOWN — No cPanel/WHM, Plesk, or DirectAdmin with Acronis plugin detected on this host."
  exit 2
elif [ "$VULNERABLE" -eq 1 ]; then
  echo "VULNERABLE — CVE-2026-87886 affects this host. Patch immediately (KEV-listed, actively exploited)."
  exit 1
else
  echo "PATCHED — Acronis Backup plugin is at or above the fixed build."
  exit 0
fi