#!/bin/bash
# CVE-2024-3094-checker.sh
# Quick and dirty PoC for checking whether a vulnerable version of xz-utils is installed
# https://nvd.nist.gov/vuln/detail/CVE-2024-3094
# Author Baroni Fabio

# This shell script is provided as-is and without warranty of any kind, express or implied.
# By executing this script, you acknowledge that you do so at your own risk.
# The author(s) of this script shall not be liable for any damages or issues that may arise from its use, including but not limited to data loss, system instability, or any other unintended consequences. 
# It is recommended to review the script and understand its functionality before running it, and to ensure that appropriate backups are in place.
# Use of this script implies your acceptance of these terms.


# Detect package manager
if command -v apt-get &>/dev/null; then
    PKG_MANAGER="apt-get"
elif command -v yum &>/dev/null; then
    PKG_MANAGER="yum"
elif command -v zypper &>/dev/null; then
    PKG_MANAGER="zypper"
else
    echo "Unsupported package manager. Exiting."
    exit 1
fi

if [ "$PKG_MANAGER" = "zypper" ]; then

    version=$(rpm -q xz)
    if [[ $version =~ (5\.6\.(0|1)) && ! $version =~ revertto ]]; then
        echo "It seems you have a vulnerable version of the xz package installed on your system"
        echo "OpenSuse has released a patched version that avoids this CVE, running zypper to update the xz package..."
        sudo zypper refresh
        sudo zypper update xz
        if [ $? -eq 0 ]; then
            echo "xz package updated successfully. Now it is advisable to reboot"
        else
            echo "xz package update failed"
        fi
        
        if lsb_release -d | grep -q "Tumbleweed"; then
            echo "OpenSuse recommends openSUSE Tumbleweed users where SSH is exposed to the internet to make a fresh installation of the system and change credentials, as it’s unknown if the backdoor has been exploited."
            echo "Due to the sophisticated nature of the backdoor an on-system detection of a breach is likely not possible."
            echo "Also rotation of any credentials that could have been fetched from the system is highly recommended."
        fi
    else
        echo "Your OpenSuse installation is probably safe."
    fi
elif [ "$PKG_MANAGER" = "apt-get" ]; then
    version=$(dpkg -l | grep "xz-utils" | awk '{print $3}')
    if [[ "$version" == *"5.6.0"* || "$version" == *"5.6.1"* ]]; then
        echo "Vulnerable version of xz-utils found: $version"
        read -p "Do you want to attempt installing the stable uncompromised xz-utils 5.4.6 version from source? (y/n): " choice
        if [[ "$choice" == "y" || "$choice" == "Y" ]]; then
            echo "Downloading xz-utils 5.4.6 from source..."
            wget https://github.com/tukaani-project/xz/releases/download/v5.4.6/xz-5.4.6.tar.gz
            tar -zxvf xz-5.4.6.tar.gz
            cd xz-5.4.6
            echo "Configuring xz-utils..."
            ./configure
            echo "Compiling xz-utils..."
            make
            echo "Installing xz-utils..."
            sudo make install
            echo "xz-utils 5.4.6 installed successfully."
        else
            echo "You chose not to install the package automatically. Install manually if needed. Exiting."
        fi
    else
        echo "You appear to be safe."
    fi
fi
