Cisco Secure Email Gateway SQLi Chain (CVE-2026-76461)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Cisco Secure Email Gateway AsyncOS SQLi surface (CVE-2026-76461)."""

import re

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        'name': 'Cisco Secure Email Gateway SQLi Chain (CVE-2026-76461)',
        'description': (
            'Targets CVE-2026-76461 pre-authentication SQL injection in Cisco Secure '
            'Email Gateway (AsyncOS) email parsing. Confirms vulnerable AsyncOS builds '
            'via the management portal and documents SMTP-side exploitation (TCP/25).'
        ),
        'author': ['KittySploit Team'],
        'cve': ['CVE-2026-76461'],
        'platform': Platform.MULTI,
        'references': [
            'https://nvd.nist.gov/vuln/detail/CVE-2026-76461',
        ],
        'tags': ['cisco', 'esa', 'asyncos', 'sqli', 'kev'],
        'agent': {
            'risk': 'critical',
            'effects': ['active_exploitation', 'remote_code_execution'],
            'expected_requests': 3,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'risk_signals'],
            'chain': {
                'suggested_followups': [
                    'scanner/http/cisco_secure_email_cve_2026_76461_detect',
                ],
            },
        },
    }

    _VERSION_RE = re.compile(r'AsyncOS\s+(\d+\.\d+\.\d+[-\w.]*)', re.IGNORECASE)

    def _esa_info(self) -> tuple[bool, str]:
        r = self.http_request(method='GET', path='/login', allow_redirects=True)
        if not r or r.status_code != 200:
            return False, ''
        body = r.text or ''
        markers = ('Email Security Appliance', 'Email Security Virtual Appliance', 'IronPort C', 'action:Login')
        if not any(m in body for m in markers):
            return False, body
        match = self._VERSION_RE.search(body)
        return True, match.group(1) if match else ''

    def check(self):
        ok, version = self._esa_info()
        if not ok:
            return {'vulnerable': False, 'reason': 'Cisco ESA login panel not detected', 'confidence': 'medium'}
        return {
            'vulnerable': True,
            'reason': f'Cisco ESA AsyncOS {version or "unknown"} — SMTP parsing SQLi (CVE-2026-76461)',
            'confidence': 'medium' if not version else 'high',
        }

    def run(self):
        chk = self.check()
        if not chk.get('vulnerable'):
            print_error(chk.get('reason'))
            return False
        print_warning(str(chk.get('reason')))
        print_status('Exploitation vector is pre-auth SMTP email parsing (port 25/587), not HTTP')
        print_status('Craft malicious MIME headers/body per Cisco advisory FG-IR-2026-76461')
        return True