Altium 365 SearchService missing authentication in legacy SOAP endpoint

#!/usr/bin/env python3
# altium365_searchservice_check.py
# Heuristic check for CVE-2026-9152-style unauthenticated SearchService exposure
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import sys
import urllib.request
import urllib.error
import urllib.parse
import ssl
import re

CANDIDATE_PATHS = [
    "/SearchService.svc?wsdl",
    "/SearchService.svc?singleWsdl",
    "/SearchService.svc",
    "/search/SearchService.svc?wsdl",
    "/search/SearchService.svc?singleWsdl",
    "/search/SearchService.svc",
    "/services/SearchService.svc?wsdl",
    "/services/SearchService.svc",
]

SOAP_PROBE = b'''<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
               xmlns:xsd="http://www.w3.org/2001/XMLSchema"
               xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body />
</soap:Envelope>'''

AUTH_PATTERNS = [
    re.compile(r'login', re.I),
    re.compile(r'sign\s*in', re.I),
    re.compile(r'authorization', re.I),
    re.compile(r'bearer', re.I),
]

SERVICE_PATTERNS = [
    re.compile(r'<wsdl:definitions', re.I),
    re.compile(r'<definitions', re.I),
    re.compile(r'SearchService', re.I),
    re.compile(r'soap:Envelope', re.I),
    re.compile(r'tempuri\.org', re.I),
    re.compile(r'http://schemas\.xmlsoap\.org/wsdl/', re.I),
]


def normalize_base(url: str) -> str:
    if not url.startswith("http://") and not url.startswith("https://"):
        url = "https://" + url
    parsed = urllib.parse.urlparse(url)
    if not parsed.scheme or not parsed.netloc:
        raise ValueError("Invalid workspace URL")
    return f"{parsed.scheme}://{parsed.netloc}"


def fetch(url: str, method: str = "GET", data: bytes = None, headers: dict = None, timeout: int = 10):
    req = urllib.request.Request(url, data=data, method=method)
    for k, v in (headers or {}).items():
        req.add_header(k, v)
    ctx = ssl.create_default_context()
    try:
        with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:
            body = resp.read(4096).decode("utf-8", errors="replace")
            return resp.getcode(), dict(resp.headers), body, None
    except urllib.error.HTTPError as e:
        try:
            body = e.read(4096).decode("utf-8", errors="replace")
        except Exception:
            body = ""
        return e.code, dict(e.headers), body, None
    except Exception as e:
        return None, {}, "", str(e)


def looks_like_auth_gate(code: int, headers: dict, body: str) -> bool:
    if code in (401, 403):
        return True
    loc = headers.get("Location", "")
    if code in (301, 302, 303, 307, 308) and any(p.search(loc) for p in AUTH_PATTERNS):
        return True
    if any(p.search(body) for p in AUTH_PATTERNS):
        return True
    return False


def looks_like_exposed_service(code: int, body: str) -> bool:
    if code != 200:
        return False
    return any(p.search(body) for p in SERVICE_PATTERNS)


def main():
    if len(sys.argv) != 2:
        print("UNKNOWN - usage: python3 altium365_searchservice_check.py https://yourworkspace.365.altium.com")
        sys.exit(2)

    try:
        base = normalize_base(sys.argv[1])
    except Exception as e:
        print(f"UNKNOWN - invalid input: {e}")
        sys.exit(2)

    saw_network_error = False
    saw_auth_or_notfound = False
    findings = []

    for path in CANDIDATE_PATHS:
        url = base + path
        code, headers, body, err = fetch(url, method="GET", headers={"User-Agent": "noisgate-check/1.0"})
        if err:
            saw_network_error = True
            findings.append(f"GET {url} -> network error: {err}")
            continue

        findings.append(f"GET {url} -> HTTP {code}")

        if looks_like_exposed_service(code, body) and not looks_like_auth_gate(code, headers, body):
            print("VULNERABLE - unauthenticated service metadata exposed")
            for f in findings:
                print(f)
            sys.exit(1)

        if code in (401, 403, 404) or looks_like_auth_gate(code, headers, body):
            saw_auth_or_notfound = True
            continue

        if code == 200:
            # Try a blank SOAP POST; vulnerable services often respond with SOAP faults without auth
            pcode, pheaders, pbody, perr = fetch(
                url.split("?")[0],
                method="POST",
                data=SOAP_PROBE,
                headers={
                    "User-Agent": "noisgate-check/1.0",
                    "Content-Type": "text/xml; charset=utf-8",
                    "SOAPAction": '""'
                }
            )
            if perr:
                saw_network_error = True
                findings.append(f"POST {url.split('?')[0]} -> network error: {perr}")
                continue
            findings.append(f"POST {url.split('?')[0]} -> HTTP {pcode}")
            if looks_like_exposed_service(pcode, pbody) and not looks_like_auth_gate(pcode, pheaders, pbody):
                print("VULNERABLE - unauthenticated SOAP interaction appears possible")
                for f in findings:
                    print(f)
                sys.exit(1)
            if pcode in (401, 403, 404) or looks_like_auth_gate(pcode, pheaders, pbody):
                saw_auth_or_notfound = True

    if saw_auth_or_notfound and not saw_network_error:
        print("PATCHED - tested candidate paths require auth, redirect to login, or are absent")
        for f in findings:
            print(f)
        sys.exit(0)

    print("UNKNOWN - no positive exposure found, but endpoint path could not be confidently determined")
    for f in findings:
        print(f)
    sys.exit(2)


if __name__ == "__main__":
    main()