VeloCloud Orchestrator

#!/usr/bin/env bash
# CVE-2026-93952 VeloCloud Orchestrator on-prem vulnerability checker
# Run on the VCO host as root.
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 2=VULNERABLE, 0=PATCHED, 1=UNKNOWN

set -euo pipefail

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

echo "=== CVE-2026-93952 VeloCloud Orchestrator Check ==="
echo "Date: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
echo ""

# --- Step 1: Check for IOCs first (compromise indicators) ---
echo "[*] Checking for known IOCs..."
ioc_found=0
for f in /usr/local/sbin/.vcnode.js /usr/local/sbin/vc-sysmond /etc/systemd/system/vc-sysmon.service; do
  if [ -f "$f" ]; then
    echo -e "${RED}[!] IOC FOUND: $f exists!${NC}"
    ioc_found=1
  fi
done

if [ -f /usr/local/sbin/vc-sysmond ]; then
  actual_md5=$(md5sum /usr/local/sbin/vc-sysmond 2>/dev/null | awk '{print $1}')
  if [ "$actual_md5" = "dc78e206eaeadec59fc5801fe4556bd0" ]; then
    echo -e "${RED}[!] IOC CONFIRMED: vc-sysmond MD5 matches known malicious hash!${NC}"
  fi
fi

if [ $ioc_found -eq 1 ]; then
  echo -e "${RED}[!!!] ACTIVE COMPROMISE DETECTED — initiate incident response immediately.${NC}"
fi

# --- Step 2: Determine VCO version ---
echo ""
echo "[*] Detecting VCO version..."
VCO_VERSION=""

# Try common version file locations
for vfile in /opt/vc/VERSION /opt/velocloud/VERSION /etc/velocloud/version; do
  if [ -f "$vfile" ]; then
    VCO_VERSION=$(cat "$vfile" | grep -oP '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | head -1)
    break
  fi
done

# Fallback: try vco-version or similar CLI
if [ -z "$VCO_VERSION" ]; then
  VCO_VERSION=$(command -v vco-version >/dev/null 2>&1 && vco-version 2>/dev/null | grep -oP '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)
fi

if [ -z "$VCO_VERSION" ]; then
  echo -e "${YELLOW}[?] Could not determine VCO version automatically.${NC}"
  echo "UNKNOWN"
  exit 1
fi

echo "[*] Detected VCO version: $VCO_VERSION"

# --- Step 3: Parse version and check against vulnerable ranges ---
IFS='.' read -r major minor patch build <<< "$VCO_VERSION"
train="${major}.${minor}"

vulnerable=0
case "$train" in
  5.2)
    if [ "$patch" -lt 3 ] || ([ "$patch" -eq 3 ] && [ "$build" -le 15 ]); then
      vulnerable=1
    fi
    ;;
  6.1)
    if [ "$patch" -lt 3 ] || ([ "$patch" -eq 3 ] && [ "$build" -le 7 ]); then
      vulnerable=1
      echo -e "${YELLOW}[!] WARNING: 6.1.x patch is NOT YET AVAILABLE from Arista.${NC}"
    fi
    ;;
  6.4)
    if [ "$patch" -lt 2 ] || ([ "$patch" -eq 2 ] && [ "$build" -le 7 ]); then
      vulnerable=1
    fi
    ;;
  7.0)
    if [ "$patch" -lt 0 ] || ([ "$patch" -eq 0 ] && [ "$build" -le 2 ]); then
      vulnerable=1
      echo -e "${YELLOW}[!] WARNING: 7.0.x patch is NOT YET AVAILABLE from Arista.${NC}"
    fi
    ;;
  *)
    echo -e "${YELLOW}[?] Unrecognized release train: $train${NC}"
    echo "UNKNOWN"
    exit 1
    ;;
esac

# --- Step 4: Check authentication mode ---
echo ""
echo "[*] Checking Edge authentication mode..."
cert_mode="unknown"
# Check VCO properties for certificate auth setting
for cfg in /opt/vc/portal/config/config.json /opt/velocloud/portal/config.json; do
  if [ -f "$cfg" ]; then
    if grep -qiE '"edgeAuth".*"cert"' "$cfg" 2>/dev/null; then
      cert_mode="certificate"
    elif grep -qiE '"edgeAuth".*"psk"' "$cfg" 2>/dev/null; then
      cert_mode="psk"
    fi
    break
  fi
done

if [ "$cert_mode" = "psk" ]; then
  echo -e "${GREEN}[*] Edge auth mode: PSK (pre-shared key) — NOT VULNERABLE to this CVE.${NC}"
  echo "PATCHED"
  exit 0
elif [ "$cert_mode" = "certificate" ]; then
  echo -e "${YELLOW}[*] Edge auth mode: Certificate-based — EXPOSED to this CVE if version is vulnerable.${NC}"
else
  echo -e "${YELLOW}[?] Could not determine Edge auth mode. Assume certificate-based for safety.${NC}"
fi

# --- Step 5: Final verdict ---
echo ""
if [ $vulnerable -eq 1 ]; then
  echo -e "${RED}=== VULNERABLE ===${NC}"
  echo -e "${RED}VCO $VCO_VERSION is in the affected range for CVE-2026-93952.${NC}"
  echo -e "Apply patch immediately. Fixed versions: 5.2.3.16 (5.2 train), 6.4.2.8 (6.4 train)."
  echo -e "6.1.x and 7.0.x patches are PENDING from Arista."
  echo "VULNERABLE"
  exit 2
else
  echo -e "${GREEN}=== PATCHED ===${NC}"
  echo -e "${GREEN}VCO $VCO_VERSION is at or above the fixed version.${NC}"
  echo "PATCHED"
  exit 0
fi