Prior to Apache HTTP Server 2

#!/usr/bin/env bash
# check-cve-2022-37436.sh
# Detect likely exposure to CVE-2022-37436 on Linux Apache HTTP Server hosts.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

status="UNKNOWN"
reason="could not determine"
server_bin=""
server_ver=""
mods=""

have_cmd() { command -v "$1" >/dev/null 2>&1; }
ver_lt() { [ "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ]; }
ver_ge() { [ "$(printf '%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]; }

find_apache() {
  for c in apache2 httpd apachectl apache2ctl; do
    if have_cmd "$c"; then
      echo "$c"
      return 0
    fi
  done
  return 1
}

extract_ver() {
  "$1" -v 2>/dev/null | sed -n 's/.*Apache\/[[:space:]]*\([0-9.][0-9.]*\).*/\1/p' | head -n1
}

list_mods() {
  local c="$1"
  if "$c" -M >/dev/null 2>&1; then
    "$c" -M 2>/dev/null
    return 0
  fi
  if have_cmd apachectl && apachectl -M >/dev/null 2>&1; then
    apachectl -M 2>/dev/null
    return 0
  fi
  if have_cmd apache2ctl && apache2ctl -M >/dev/null 2>&1; then
    apache2ctl -M 2>/dev/null
    return 0
  fi
  return 1
}

pkg_ver_deb() {
  dpkg-query -W -f='${Version}\n' apache2 2>/dev/null | head -n1
}

pkg_ver_rpm() {
  rpm -q --qf '%{VERSION}-%{RELEASE}\n' httpd 2>/dev/null | head -n1
}

is_proxy_loaded() {
  echo "$mods" | grep -Eiq 'proxy(_http|_ajp|_fcgi|_uwsgi|_http2)?_module|proxy_module'
}

server_bin="$(find_apache || true)"
if [ -z "$server_bin" ]; then
  echo "UNKNOWN - Apache binaries not found"
  exit 2
fi

server_ver="$(extract_ver "$server_bin")"
if [ -z "$server_ver" ]; then
  echo "UNKNOWN - could not parse Apache version from $server_bin -v"
  exit 2
fi

mods="$(list_mods "$server_bin" || true)"
if [ -n "$mods" ] && ! is_proxy_loaded; then
  echo "PATCHED - Apache $server_ver found, but no proxy module appears loaded; CVE-2022-37436 targets mod_proxy response handling"
  exit 0
fi

# Debian / Ubuntu package-aware checks for known backports
if have_cmd dpkg-query; then
  pkg="$(pkg_ver_deb)"
  if [ -n "$pkg" ]; then
    . /etc/os-release 2>/dev/null || true
    case "${VERSION_CODENAME:-}" in
      jammy)
        if ver_ge "$pkg" "2.4.52-1ubuntu4.3"; then
          echo "PATCHED - Ubuntu jammy apache2 package $pkg includes the fix"
          exit 0
        fi
        ;;
      focal)
        if ver_ge "$pkg" "2.4.41-4ubuntu3.13"; then
          echo "PATCHED - Ubuntu focal apache2 package $pkg includes the fix"
          exit 0
        fi
        ;;
      bionic)
        if ver_ge "$pkg" "2.4.29-1ubuntu4.26"; then
          echo "PATCHED - Ubuntu bionic apache2 package $pkg includes the fix"
          exit 0
        fi
        ;;
      xenial)
        if ver_ge "$pkg" "2.4.18-2ubuntu3.17+esm9"; then
          echo "PATCHED - Ubuntu xenial apache2 package $pkg includes the fix"
          exit 0
        fi
        ;;
      kinetic)
        if ver_ge "$pkg" "2.4.54-2ubuntu1.1"; then
          echo "PATCHED - Ubuntu kinetic apache2 package $pkg includes the fix"
          exit 0
        fi
        ;;
    esac

    # Debian backports noted in tracker
    case "${VERSION_CODENAME:-}" in
      buster)
        if ver_ge "$pkg" "2.4.38-3+deb10u9"; then
          echo "PATCHED - Debian buster apache2 package $pkg includes the fix"
          exit 0
        fi
        ;;
      bullseye)
        if ver_ge "$pkg" "2.4.56-1~deb11u1" || ver_ge "$pkg" "2.4.62-1~deb11u1" || ver_ge "$pkg" "2.4.66-1~deb11u1"; then
          echo "PATCHED - Debian bullseye apache2 package $pkg includes the fix"
          exit 0
        fi
        ;;
      bookworm)
        if ver_ge "$pkg" "2.4.62-1~deb12u2" || ver_ge "$pkg" "2.4.66-1~deb12u1"; then
          echo "PATCHED - Debian bookworm apache2 package $pkg includes the fix"
          exit 0
        fi
        ;;
    esac
  fi
fi

# Generic upstream version fallback
if ver_ge "$server_ver" "2.4.55"; then
  echo "PATCHED - Apache upstream version $server_ver is >= 2.4.55"
  exit 0
fi

if [ -n "$mods" ] && is_proxy_loaded && ver_lt "$server_ver" "2.4.55"; then
  echo "VULNERABLE - Apache $server_ver is < 2.4.55 and proxy modules appear loaded"
  exit 1
fi

# RPM-based systems often backport; avoid false positives if package provenance is unclear
if have_cmd rpm; then
  pkg="$(pkg_ver_rpm)"
  if [ -n "$pkg" ] && ver_lt "$server_ver" "2.4.55"; then
    echo "UNKNOWN - Apache $server_ver is < 2.4.55, but RPM distros may backport fixes; inspect vendor advisory for package $pkg and confirm whether mod_proxy is in use"
    exit 2
  fi
fi

echo "UNKNOWN - Apache $server_ver detected, but exposure could not be determined confidently"
exit 2