F5 BIG-IP APM OAuth Authorization Server Heap-Based Buffer Overflow RCE

#!/bin/bash
# check_cve_2026_94127.sh — CVE-2026-94127 Vulnerability & Compromise Check
# Run on BIG-IP appliance as root. Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 2=VULNERABLE, 0=PATCHED, 1=UNKNOWN

set -euo pipefail

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; NC='\033[0m'

# Get BIG-IP version
VERSION=$(tmsh show sys version | grep -oP 'Version\s+\K[0-9]+\.[0-9]+\.[0-9]+' | head -1 2>/dev/null || echo "")
if [ -z "$VERSION" ]; then
    echo -e "${YELLOW}[UNKNOWN]${NC} Could not determine BIG-IP version. Is this a BIG-IP system?"
    exit 1
fi

echo "[*] BIG-IP Version: $VERSION"

# Check if version is in affected range
AFFECTED=0
case "$VERSION" in
    17.1.[0-3]*) AFFECTED=1; BRANCH="17.1.x" ;;
    17.5.[0-1]*) AFFECTED=1; BRANCH="17.5.x" ;;
    21.1.0*)     AFFECTED=1; BRANCH="21.1.x" ;;
    *)           AFFECTED=0 ;;
esac

if [ "$AFFECTED" -eq 0 ]; then
    echo -e "${GREEN}[PATCHED]${NC} Version $VERSION is not in an affected branch (17.1.0-17.1.3, 17.5.0-17.5.1, 21.1.0)."
    exit 0
fi

echo -e "${YELLOW}[*]${NC} Version $VERSION is in affected branch $BRANCH."

# Check for engineering hotfix
HOTFIX=$(tmsh show sys version | grep -i 'Hotfix' | head -1 || echo "")
if echo "$HOTFIX" | grep -qiE '(21\.1\.0\.2\.0\.30\.22|17\.5\.1\.9\.0\.160\.12|17\.1\.3\.5\.0\.41\.14)'; then
    echo -e "${GREEN}[PATCHED]${NC} Engineering hotfix detected: $HOTFIX"
    exit 0
fi

# Check for OAuth Authorization Server profile on virtual servers
echo "[*] Checking for OAuth Authorization Server profiles on virtual servers..."
OAUTH_AS=$(tmsh list apm oauth server 2>/dev/null || echo "")
if [ -z "$OAUTH_AS" ] || echo "$OAUTH_AS" | grep -q "was not found"; then
    echo -e "${GREEN}[PATCHED]${NC} No OAuth Authorization Server profiles found. Version $VERSION is affected but configuration is not vulnerable."
    echo "    Note: Re-check if OAuth AS profiles are added in the future."
    exit 0
fi

echo -e "${RED}[VULNERABLE]${NC} BIG-IP $VERSION with OAuth Authorization Server profile(s) detected."
echo "    Affected OAuth AS config:"
echo "$OAUTH_AS" | head -20

# Compromise indicators
echo ""
echo "[*] Checking for compromise indicators..."
TMM_FINISH="/etc/bigstart/scripts/tmm.finish"
if [ -f "$TMM_FINISH" ]; then
    FINISH_HASH=$(md5sum "$TMM_FINISH" | awk '{print $1}')
    FINISH_MTIME=$(stat -c '%y' "$TMM_FINISH" 2>/dev/null || stat -f '%Sm' "$TMM_FINISH" 2>/dev/null)
    echo "    tmm.finish hash:  $FINISH_HASH"
    echo "    tmm.finish mtime: $FINISH_MTIME"
    # Check for suspicious content (non-standard entries)
    if grep -qiE '(curl|wget|nc |ncat|bash -i|/dev/tcp|python|perl|ruby|base64)' "$TMM_FINISH" 2>/dev/null; then
        echo -e "    ${RED}[!] SUSPICIOUS CONTENT in tmm.finish — possible post-exploitation tampering!${NC}"
    fi
fi

# Check for TMM crashes
SIGABRT_COUNT=$(grep -c 'SIGABRT' /var/log/ltm 2>/dev/null || echo "0")
if [ "$SIGABRT_COUNT" -gt 0 ]; then
    echo -e "    ${YELLOW}[!] $SIGABRT_COUNT SIGABRT entries in /var/log/ltm — review for exploitation attempts.${NC}"
fi

# Check for OAuth brute patterns
INVALID_TOKEN=$(grep -c 'invalid_token' /var/log/apm 2>/dev/null || echo "0")
if [ "$INVALID_TOKEN" -gt 10 ]; then
    echo -e "    ${YELLOW}[!] $INVALID_TOKEN invalid_token entries in /var/log/apm — review source IPs.${NC}"
fi

echo ""
echo -e "${RED}VULNERABLE${NC} — Apply hotfix for $BRANCH immediately. See F5 K000162605."
exit 2