Apache Struts 2

#!/usr/bin/env python3
# check_struts_cve_2013_2251.py
# Detect vulnerable Apache Struts 2 versions for CVE-2013-2251 (S2-016)
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=USAGE

import os
import re
import sys
import zipfile
from pathlib import Path

TARGET_FIXED = (2, 3, 15, 1)
JAR_RE = re.compile(r"struts2-core-([0-9][0-9A-Za-z_.-]*)\.jar$", re.IGNORECASE)
POM_PATH_RE = re.compile(r"META-INF/maven/.*/struts2-core/pom.properties$")


def normalize_version(v):
    v = v.strip()
    parts = re.split(r"[._-]", v)
    out = []
    for p in parts:
        if p.isdigit():
            out.append(int(p))
        else:
            m = re.match(r"(\d+)", p)
            if m:
                out.append(int(m.group(1)))
            else:
                out.append(0)
    while len(out) < 4:
        out.append(0)
    return tuple(out[:4])


def version_lt(a, b):
    return a < b


def extract_version_from_jar_name(name):
    m = JAR_RE.search(name)
    if not m:
        return None
    return m.group(1)


def extract_version_from_zip(path):
    try:
        with zipfile.ZipFile(path, 'r') as zf:
            for member in zf.namelist():
                base = os.path.basename(member)
                v = extract_version_from_jar_name(base)
                if v:
                    return v
                if POM_PATH_RE.search(member):
                    try:
                        data = zf.read(member).decode('utf-8', errors='ignore')
                        for line in data.splitlines():
                            if line.startswith('version='):
                                return line.split('=', 1)[1].strip()
                    except Exception:
                        pass
    except Exception:
        return None
    return None


def inspect_path(root):
    findings = []
    root = Path(root)
    if not root.exists():
        return findings

    for path in root.rglob('*'):
        if not path.is_file():
            continue
        lower = path.name.lower()

        if lower.endswith('.jar'):
            v = extract_version_from_jar_name(path.name)
            if v:
                findings.append((str(path), v, 'direct-jar'))
                continue

        if lower.endswith(('.war', '.ear', '.jar')):
            v = extract_version_from_zip(path)
            if v:
                findings.append((str(path), v, 'archive'))

    return findings


def main():
    if len(sys.argv) < 2:
        print('UNKNOWN - usage: python3 check_struts_cve_2013_2251.py <path1> [path2 ...]')
        sys.exit(3)

    all_findings = []
    for arg in sys.argv[1:]:
        all_findings.extend(inspect_path(arg))

    if not all_findings:
        print('UNKNOWN - no struts2-core artifacts found in supplied paths')
        sys.exit(2)

    vulnerable = []
    patched = []
    unknown = []

    for location, raw_ver, source in all_findings:
        try:
            norm = normalize_version(raw_ver)
            if version_lt(norm, TARGET_FIXED):
                vulnerable.append((location, raw_ver, source))
            else:
                patched.append((location, raw_ver, source))
        except Exception:
            unknown.append((location, raw_ver, source))

    if vulnerable:
        print('VULNERABLE')
        for location, raw_ver, source in vulnerable:
            print(f'  {location} | version={raw_ver} | source={source}')
        sys.exit(1)

    if patched and not vulnerable:
        print('PATCHED')
        for location, raw_ver, source in patched:
            print(f'  {location} | version={raw_ver} | source={source}')
        if unknown:
            for location, raw_ver, source in unknown:
                print(f'  NOTE: unable to fully classify {location} | version={raw_ver} | source={source}')
        sys.exit(0)

    print('UNKNOWN - artifacts found but version classification failed')
    for location, raw_ver, source in unknown:
        print(f'  {location} | version={raw_ver} | source={source}')
    sys.exit(2)


if __name__ == '__main__':
    main()