Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

#!/bin/bash
# check_cve_2026_88771.sh — CVE-2026-88771 NetScaler version + IOC checker
# Run on the NetScaler appliance as nsroot via SSH.
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'
RESULT="UNKNOWN"
IOC_FOUND=0

# --- Version Check ---
VERSION_OUTPUT=$(nsconmsg -d current -g version 2>/dev/null || cat /var/nslog/ns.log 2>/dev/null | grep -m1 'NetScaler' || echo '')
if [ -z "$VERSION_OUTPUT" ]; then
  VERSION_OUTPUT=$(show ns version 2>/dev/null || echo '')
fi

# Extract major.minor-build
BUILD=$(echo "$VERSION_OUTPUT" | grep -oE '[0-9]+\.[0-9]+-[0-9]+\.[0-9]+' | head -1)
if [ -z "$BUILD" ]; then
  echo -e "${YELLOW}[!] Could not determine NetScaler version.${NC}"
  echo -e "${YELLOW}[!] Manually check: show ns version${NC}"
  RESULT="UNKNOWN"
else
  MAJOR=$(echo "$BUILD" | cut -d'.' -f1)
  MINOR=$(echo "$BUILD" | cut -d'.' -f2 | cut -d'-' -f1)
  PATCH_MAJ=$(echo "$BUILD" | cut -d'-' -f2 | cut -d'.' -f1)
  PATCH_MIN=$(echo "$BUILD" | cut -d'-' -f2 | cut -d'.' -f2)
  echo "[*] Detected version: $BUILD"
  
  if [ "$MAJOR" -eq 14 ] && [ "$MINOR" -eq 1 ]; then
    # Fixed: 14.1-73.37
    if [ "$PATCH_MAJ" -gt 73 ] || ([ "$PATCH_MAJ" -eq 73 ] && [ "$PATCH_MIN" -ge 37 ]); then
      RESULT="PATCHED"
    else
      RESULT="VULNERABLE"
    fi
  elif [ "$MAJOR" -eq 13 ] && [ "$MINOR" -eq 1 ]; then
    # Fixed: 13.1-64.23
    if [ "$PATCH_MAJ" -gt 64 ] || ([ "$PATCH_MAJ" -eq 64 ] && [ "$PATCH_MIN" -ge 23 ]); then
      RESULT="PATCHED"
    else
      RESULT="VULNERABLE"
    fi
  else
    echo -e "${YELLOW}[!] Unrecognized version branch: $BUILD${NC}"
    RESULT="UNKNOWN"
  fi
fi

# --- IOC Checks ---
echo "[*] Scanning for known IOCs..."

# Check for webshell
if [ -f "/var/netscaler/logon/LogonPoint/custom/.ctxs.receiver" ]; then
  echo -e "${RED}[!] WEBSHELL FOUND: /var/netscaler/logon/LogonPoint/custom/.ctxs.receiver${NC}"
  IOC_FOUND=1
fi

# Check for webshell hash
if command -v sha256sum &>/dev/null; then
  find /var/netscaler/logon/ -name '.ctxs*' -type f 2>/dev/null | while read f; do
    HASH=$(sha256sum "$f" | awk '{print $1}')
    if [ "$HASH" = "6f5a2a452a7901323abd21879c6cecccb47c06aeeaccb1b467212f3b11e4b1e7" ]; then
      echo -e "${RED}[!] KNOWN WEBSHELL HASH MATCH: $f${NC}"
      IOC_FOUND=1
    fi
  done
fi

# Check Apache config for AliasMatch
grep -r 'receiver\.min\.' /etc/httpd/ /nsconfig/httpd* 2>/dev/null | grep -i alias && {
  echo -e "${RED}[!] Suspicious AliasMatch for receiver.min found in Apache config${NC}"
  IOC_FOUND=1
}

# Check logs for exploitation payload
grep -l 'pitboss PPE unexpectedly died NSPPE' /var/nslog/*.log /var/log/ns.log 2>/dev/null && {
  echo -e "${RED}[!] Exploitation payload signature found in logs${NC}"
  IOC_FOUND=1
}

# Check for SUID bit on /bin/sh
if [ -u /bin/sh ]; then
  echo -e "${RED}[!] /bin/sh has SUID bit set — possible post-exploitation artifact${NC}"
  IOC_FOUND=1
fi

# --- Final Output ---
echo "================================"
if [ "$IOC_FOUND" -eq 1 ]; then
  echo -e "${RED}[!!!] IOCs DETECTED — ASSUME COMPROMISED. Preserve forensics before patching.${NC}"
fi

if [ "$RESULT" = "VULNERABLE" ]; then
  echo -e "${RED}VULNERABLE — CVE-2026-88771 applies to version $BUILD${NC}"
  exit 1
elif [ "$RESULT" = "PATCHED" ]; then
  echo -e "${GREEN}PATCHED — version $BUILD is not affected by CVE-2026-88771${NC}"
  exit 0
else
  echo -e "${YELLOW}UNKNOWN — could not determine vulnerability status${NC}"
  exit 2
fi