Apache Struts 2

#!/usr/bin/env python3
# check_struts_dmi_cve_2013_4316.py
# Detect Apache Struts 2.x struts2-core versions vulnerable to CVE-2013-4316
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1=vulnerable, 0=patched, 2=unknown, 3=usage error

import os
import re
import sys
import zipfile
from typing import Optional, List, Tuple

VULN_MIN = (2, 0, 0)
VULN_MAX = (2, 3, 15, 1)

JAR_RE = re.compile(r"struts2-core-([0-9][0-9A-Za-z_.-]*)\.jar$")
POM_PATH = "META-INF/maven/org.apache.struts/struts2-core/pom.properties"
MANIFEST_PATH = "META-INF/MANIFEST.MF"


def normalize_version(v: str) -> Optional[Tuple[int, ...]]:
    if not v:
        return None
    v = v.strip()
    m = re.match(r"^(\d+(?:\.\d+)*)", v)
    if not m:
        return None
    try:
        return tuple(int(x) for x in m.group(1).split('.'))
    except ValueError:
        return None


def cmp_version(a: Tuple[int, ...], b: Tuple[int, ...]) -> int:
    maxlen = max(len(a), len(b))
    aa = a + (0,) * (maxlen - len(a))
    bb = b + (0,) * (maxlen - len(b))
    if aa < bb:
        return -1
    if aa > bb:
        return 1
    return 0


def is_vulnerable(ver: Tuple[int, ...]) -> bool:
    return cmp_version(ver, VULN_MIN) >= 0 and cmp_version(ver, VULN_MAX) <= 0


def read_props_from_jar(jar_path: str) -> Optional[str]:
    try:
        with zipfile.ZipFile(jar_path, 'r') as zf:
            if POM_PATH in zf.namelist():
                data = zf.read(POM_PATH).decode('utf-8', errors='ignore')
                for line in data.splitlines():
                    if line.startswith('version='):
                        return line.split('=', 1)[1].strip()
            if MANIFEST_PATH in zf.namelist():
                data = zf.read(MANIFEST_PATH).decode('utf-8', errors='ignore')
                for line in data.splitlines():
                    if line.lower().startswith('implementation-version:'):
                        return line.split(':', 1)[1].strip()
    except Exception:
        return None
    return None


def find_candidates(root: str) -> List[Tuple[str, Optional[str]]]:
    hits = []
    for base, _, files in os.walk(root):
        for name in files:
            path = os.path.join(base, name)
            m = JAR_RE.search(name)
            if m:
                version = m.group(1)
                jar_version = read_props_from_jar(path) or version
                hits.append((path, jar_version))
            elif name == 'pom.properties' and 'org.apache.struts' in path and 'struts2-core' in path:
                try:
                    with open(path, 'r', encoding='utf-8', errors='ignore') as f:
                        version = None
                        for line in f:
                            if line.startswith('version='):
                                version = line.split('=', 1)[1].strip()
                                break
                        hits.append((path, version))
                except Exception:
                    hits.append((path, None))
    return hits


def main() -> int:
    if len(sys.argv) != 2:
        print(f"UNKNOWN - usage: {sys.argv[0]} /path/to/app-or-webapps")
        return 3

    root = sys.argv[1]
    if not os.path.exists(root):
        print(f"UNKNOWN - path not found: {root}")
        return 2

    hits = find_candidates(root)
    if not hits:
        print("UNKNOWN - no struts2-core artifact found")
        return 2

    vulnerable = []
    patched = []
    unknown = []

    for path, raw_ver in hits:
        parsed = normalize_version(raw_ver or '')
        if parsed is None:
            unknown.append((path, raw_ver))
            continue
        if is_vulnerable(parsed):
            vulnerable.append((path, raw_ver))
        else:
            patched.append((path, raw_ver))

    if vulnerable:
        print("VULNERABLE")
        for path, ver in vulnerable:
            print(f"- {path} :: version={ver}")
        return 1

    if patched and not unknown:
        print("PATCHED")
        for path, ver in patched:
            print(f"- {path} :: version={ver}")
        return 0

    print("UNKNOWN")
    for path, ver in patched:
        print(f"- patched candidate: {path} :: version={ver}")
    for path, ver in unknown:
        print(f"- unknown candidate: {path} :: version={ver}")
    return 2


if __name__ == '__main__':
    sys.exit(main())