Inconsistent Interpretation of HTTP Requests

#!/usr/bin/env bash
# check_cve_2022_36760.sh
# Detects practical exposure to CVE-2022-36760 on Apache HTTP Server.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

APACHE_BIN="${1:-}"

find_apache_bin() {
  local c
  for c in apache2 httpd apachectl apache2ctl; do
    if command -v "$c" >/dev/null 2>&1; then
      command -v "$c"
      return 0
    fi
  done
  return 1
}

ver_ge() {
  # returns 0 if $1 >= $2
  [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

have_cmd() { command -v "$1" >/dev/null 2>&1; }

if [ -z "$APACHE_BIN" ]; then
  if ! APACHE_BIN="$(find_apache_bin)"; then
    echo "UNKNOWN - could not find apache/httpd binary"
    exit 2
  fi
fi

if [ ! -x "$APACHE_BIN" ]; then
  echo "UNKNOWN - specified binary not executable: $APACHE_BIN"
  exit 2
fi

APACHE_DIRS=(/etc/apache2 /etc/httpd /usr/local/apache2/conf)
CONFIG_HITS=""
MODULES_OUT=""
VERSION_RAW=""
VERSION=""

# Best effort version discovery
VERSION_RAW="$($APACHE_BIN -v 2>/dev/null | awk -F/ '/Server version/ {print $2}' | awk '{print $1}')"
if [ -z "$VERSION_RAW" ] && have_cmd apachectl; then
  VERSION_RAW="$(apachectl -v 2>/dev/null | awk -F/ '/Server version/ {print $2}' | awk '{print $1}')"
fi
if [ -z "$VERSION_RAW" ] && have_cmd apache2ctl; then
  VERSION_RAW="$(apache2ctl -v 2>/dev/null | awk -F/ '/Server version/ {print $2}' | awk '{print $1}')"
fi
VERSION="$VERSION_RAW"

# Module listing
if "$APACHE_BIN" -M >/dev/null 2>&1; then
  MODULES_OUT="$($APACHE_BIN -M 2>/dev/null)"
elif have_cmd apachectl && apachectl -M >/dev/null 2>&1; then
  MODULES_OUT="$(apachectl -M 2>/dev/null)"
elif have_cmd apache2ctl && apache2ctl -M >/dev/null 2>&1; then
  MODULES_OUT="$(apache2ctl -M 2>/dev/null)"
fi

HAS_PROXY_AJP=0
if printf '%s' "$MODULES_OUT" | grep -qi 'proxy_ajp_module'; then
  HAS_PROXY_AJP=1
fi

# Config search for ajp usage
for d in "${APACHE_DIRS[@]}"; do
  if [ -d "$d" ]; then
    HITS=$(grep -RInE 'ajp://|proxy_ajp_module|LoadModule[[:space:]]+proxy_ajp_module' "$d" 2>/dev/null || true)
    if [ -n "$HITS" ]; then
      CONFIG_HITS+="$HITS"$'\n'
    fi
  fi
done

HAS_AJP_CONFIG=0
if [ -n "$CONFIG_HITS" ]; then
  HAS_AJP_CONFIG=1
fi

# If AJP is not in use, this CVE is not practically reachable on this host.
if [ "$HAS_PROXY_AJP" -eq 0 ] && [ "$HAS_AJP_CONFIG" -eq 0 ]; then
  echo "PATCHED - no evidence of mod_proxy_ajp or ajp:// backend usage"
  exit 0
fi

# Upstream version fixed in 2.4.55+
if [ -n "$VERSION" ] && ver_ge "$VERSION" "2.4.55"; then
  echo "PATCHED - Apache version $VERSION is upstream-fixed and AJP usage was detected"
  exit 0
fi

# Ubuntu/Debian backport handling
if have_cmd dpkg-query; then
  PKG_VER="$(dpkg-query -W -f='${Version}' apache2 2>/dev/null || true)"
  CODENAME="$(. /etc/os-release 2>/dev/null; echo ${VERSION_CODENAME:-})"
  if [ -n "$PKG_VER" ]; then
    case "$CODENAME" in
      jammy)
        if dpkg --compare-versions "$PKG_VER" ge "2.4.52-1ubuntu4.3"; then
          echo "PATCHED - Ubuntu Jammy apache2 package $PKG_VER includes the fix/backport"
          exit 0
        fi
        ;;
      focal)
        if dpkg --compare-versions "$PKG_VER" ge "2.4.41-4ubuntu3.13"; then
          echo "PATCHED - Ubuntu Focal apache2 package $PKG_VER includes the fix/backport"
          exit 0
        fi
        ;;
      bionic)
        if dpkg --compare-versions "$PKG_VER" ge "2.4.29-1ubuntu4.26"; then
          echo "PATCHED - Ubuntu Bionic apache2 package $PKG_VER includes the fix/backport"
          exit 0
        fi
        ;;
      xenial)
        if dpkg --compare-versions "$PKG_VER" ge "2.4.18-2ubuntu3.17+esm8"; then
          echo "PATCHED - Ubuntu Xenial apache2 package $PKG_VER includes the fix/backport"
          exit 0
        fi
        ;;
    esac

    # Debian and derivative packages often backport fixes without obvious upstream version numbers.
    echo "UNKNOWN - AJP usage detected and apache2 package version is $PKG_VER; verify distro backport status in vendor advisory"
    exit 2
  fi
fi

# RPM-based distros also commonly backport httpd fixes.
if have_cmd rpm && rpm -q httpd >/dev/null 2>&1; then
  RPM_VER="$(rpm -q --qf '%{VERSION}-%{RELEASE}\n' httpd 2>/dev/null || true)"
  echo "UNKNOWN - AJP usage detected and RPM package httpd-$RPM_VER may contain a backport; check vendor errata"
  exit 2
fi

# Source builds or simple upstream packages: if older than 2.4.55 and AJP is active, treat as vulnerable.
if [ -n "$VERSION" ] && ! ver_ge "$VERSION" "2.4.55"; then
  echo "VULNERABLE - Apache version $VERSION with active mod_proxy_ajp/ajp:// usage"
  exit 1
fi

echo "UNKNOWN - insufficient data to prove patched state, but AJP usage was detected"
exit 2