Arista VeloCloud Orchestrator pre-auth privileged access via certificate-based authentication bypass

#!/usr/bin/env bash
# CVE-2026-93952 VeloCloud Orchestrator Verification Script
# Run on each VCO on-prem host as root
# Outputs: VULNERABLE / PATCHED / COMPROMISED / UNKNOWN
# Exit codes: 2=COMPROMISED, 1=VULNERABLE, 0=PATCHED, 3=UNKNOWN

set -euo pipefail

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

COMPROMISED=0
VULNERABLE=0

echo "=== CVE-2026-93952 VeloCloud Orchestrator Check ==="
echo "Date: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
echo ""

# --- IoC Hunt ---
echo "[1/3] Hunting for known indicators of compromise..."

IOC_FILES=(
  "/usr/local/sbin/.vcnode.js"
  "/usr/local/sbin/vc-sysmond"
)

MAL_MD5="dc78e206eaeadec59fc5801fe4556bd0"

for f in "${IOC_FILES[@]}"; do
  if [ -f "$f" ]; then
    echo -e "${RED}[!] COMPROMISED: Backdoor file found: $f${NC}"
    FILE_MD5=$(md5sum "$f" 2>/dev/null | awk '{print $1}' || echo "unknown")
    echo "    MD5: $FILE_MD5"
    if [ "$FILE_MD5" = "$MAL_MD5" ]; then
      echo -e "${RED}    [!] MD5 matches known malicious hash${NC}"
    fi
    COMPROMISED=1
  fi
done

# Check nginx logs for x-vc-opt header
NGINX_LOGS=$(find /var/log/nginx/ -name '*.log*' 2>/dev/null || true)
if [ -n "$NGINX_LOGS" ]; then
  if grep -rl 'x-vc-opt' /var/log/nginx/ 2>/dev/null; then
    echo -e "${RED}[!] COMPROMISED: x-vc-opt header found in nginx logs${NC}"
    COMPROMISED=1
  else
    echo "    No x-vc-opt header found in nginx logs (good)"
  fi
else
  echo "    No nginx logs found to inspect"
fi

# Check for known attacker IPs in logs
ATTACKER_IPS=("142.93.149.77" "104.248.126.159")
for ip in "${ATTACKER_IPS[@]}"; do
  if grep -rl "$ip" /var/log/nginx/ 2>/dev/null; then
    echo -e "${RED}[!] COMPROMISED: Known attacker IP $ip found in nginx logs${NC}"
    COMPROMISED=1
  fi
done

if [ "$COMPROMISED" -eq 1 ]; then
  echo ""
  echo -e "${RED}*** COMPROMISE INDICATORS DETECTED ***${NC}"
  echo "STOP: Preserve evidence. Do NOT patch yet. Initiate incident response."
  echo "Result: COMPROMISED"
  exit 2
fi

echo "    No IoCs detected (check is non-exhaustive)"
echo ""

# --- Version Check ---
echo "[2/3] Checking VCO version..."

# VCO version is typically in /etc/vco-version or via the API
VCO_VERSION=""
if [ -f /etc/vco-version ]; then
  VCO_VERSION=$(cat /etc/vco-version | head -1 | tr -d '[:space:]')
elif [ -f /opt/vc/vco/version.txt ]; then
  VCO_VERSION=$(cat /opt/vc/vco/version.txt | head -1 | tr -d '[:space:]')
elif command -v vco-version &>/dev/null; then
  VCO_VERSION=$(vco-version 2>/dev/null | head -1 | tr -d '[:space:]')
fi

if [ -z "$VCO_VERSION" ]; then
  echo -e "${YELLOW}    Could not determine VCO version automatically${NC}"
  echo "    Check manually: cat /etc/vco-version or VCO admin UI"
  echo ""
  echo "    Known vulnerable: 5.2.0-5.2.3.15, 6.1.0-6.1.3.7, 6.4.0-6.4.2.7, 7.0.0-7.0.0.2"
  echo "    Fixed: 5.2.3.16+, 6.4.2.8+ (6.1.x and 7.0.x: NO FIX AVAILABLE)"
  echo "Result: UNKNOWN"
  exit 3
fi

echo "    Detected VCO version: $VCO_VERSION"

# Parse major.minor.patch.build
IFS='.' read -ra VER <<< "$VCO_VERSION"
MAJOR=${VER[0]:-0}
MINOR=${VER[1]:-0}
PATCH=${VER[2]:-0}
BUILD=${VER[3]:-0}

check_vulnerable() {
  # 5.2.x train: vulnerable if <= 5.2.3.15
  if [ "$MAJOR" -eq 5 ] && [ "$MINOR" -eq 2 ]; then
    if [ "$PATCH" -lt 3 ] || ([ "$PATCH" -eq 3 ] && [ "$BUILD" -le 15 ]); then
      return 0  # vulnerable
    fi
    return 1  # patched
  fi
  # 6.1.x train: vulnerable, NO FIX
  if [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 1 ]; then
    return 0  # vulnerable, no fix available
  fi
  # 6.4.x train: vulnerable if <= 6.4.2.7
  if [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 4 ]; then
    if [ "$PATCH" -lt 2 ] || ([ "$PATCH" -eq 2 ] && [ "$BUILD" -le 7 ]); then
      return 0  # vulnerable
    fi
    return 1  # patched
  fi
  # 7.0.x train: vulnerable, NO FIX
  if [ "$MAJOR" -eq 7 ] && [ "$MINOR" -eq 0 ]; then
    return 0  # vulnerable, no fix available
  fi
  return 1  # unknown/other train, assume not vulnerable
}

if check_vulnerable; then
  VULNERABLE=1
  echo -e "${RED}    Version $VCO_VERSION is VULNERABLE to CVE-2026-93952${NC}"
  if ([ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 1 ]) || ([ "$MAJOR" -eq 7 ] && [ "$MINOR" -eq 0 ]); then
    echo -e "${RED}    WARNING: No patch available for this train. Apply network mitigations immediately.${NC}"
  fi
else
  echo -e "${GREEN}    Version $VCO_VERSION appears PATCHED${NC}"
fi

echo ""

# --- Certificate Auth Check ---
echo "[3/3] Checking if certificate-based Edge authentication is configured..."
echo "    (Manual check required: verify Edge authentication mode in VCO admin UI)"
echo "    If PSK-only authentication is in use, the attack surface for this CVE is absent."
echo ""

# --- Final Verdict ---
echo "========================================"
if [ "$VULNERABLE" -eq 1 ]; then
  echo -e "${RED}Result: VULNERABLE${NC}"
  echo "Action: Apply patch (5.2.3.16+ or 6.4.2.8+) or restrict VCO web interface access immediately."
  exit 1
else
  echo -e "${GREEN}Result: PATCHED${NC}"
  exit 0
fi