Tsinghua Unigroup Electronic Archives System downLoad.html information disclosure

#!/usr/bin/env python3
# check_cve_2025_0227.py
# Offline checker for CVE-2025-0227 in Tsinghua Unigroup Electronic Archives System
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/runtime error

import argparse
import os
import re
import sys
from pathlib import Path

AFFECTED_VERSION = "3.2.210802(62532)"
ENDPOINT_SUFFIX = Path("Logs") / "Annals" / "downLoad.html"
PRODUCT_HINTS = [
    "Electronic Archives System",
    "Tsinghua Unigroup",
    "Archives",
    "电子档案",
]
VERSION_FILE_CANDIDATES = [
    "version.txt",
    "VERSION",
    "build.txt",
    "manifest.mf",
    "pom.properties",
    "application.properties",
]
MAX_SCAN_FILES = 4000
MAX_READ_BYTES = 2 * 1024 * 1024


def read_text_safely(path: Path):
    try:
        if path.stat().st_size > MAX_READ_BYTES:
            return None
        return path.read_text(encoding="utf-8", errors="ignore")
    except Exception:
        return None


def find_endpoint(root: Path):
    matches = []
    for p in root.rglob("downLoad.html"):
        try:
            rel = p.relative_to(root)
        except Exception:
            rel = p
        if str(rel).replace('\\', '/').endswith(str(ENDPOINT_SUFFIX).replace('\\', '/')):
            matches.append(p)
    return matches


def scan_for_version_and_product(root: Path):
    version_match = False
    product_hint = False
    scanned = 0

    preferred = []
    for name in VERSION_FILE_CANDIDATES:
        preferred.extend(root.rglob(name))

    seen = set()
    ordered_paths = []
    for p in preferred:
        if p.is_file() and p not in seen:
            ordered_paths.append(p)
            seen.add(p)

    for p in root.rglob("*"):
        if scanned >= MAX_SCAN_FILES:
            break
        if p.is_file() and p not in seen:
            ordered_paths.append(p)
            seen.add(p)
        scanned += 1

    for p in ordered_paths:
        text = read_text_safely(p)
        if not text:
            continue
        if AFFECTED_VERSION in text:
            version_match = True
        for hint in PRODUCT_HINTS:
            if hint.lower() in text.lower():
                product_hint = True
                break
        if version_match and product_hint:
            break

    return version_match, product_hint


def main():
    parser = argparse.ArgumentParser(description="Offline check for CVE-2025-0227")
    parser.add_argument("--root", required=True, help="Application installation root")
    args = parser.parse_args()

    root = Path(args.root)
    if not root.exists() or not root.is_dir():
        print("UNKNOWN - installation root not found or not a directory")
        return 2

    endpoint_hits = find_endpoint(root)
    version_match, product_hint = scan_for_version_and_product(root)

    if endpoint_hits and version_match:
        print("VULNERABLE - found affected version '{}' and endpoint '{}'".format(
            AFFECTED_VERSION, ENDPOINT_SUFFIX.as_posix()
        ))
        return 1

    if product_hint and not endpoint_hits:
        print("PATCHED - product indicators found but vulnerable endpoint '{}' not present".format(
            ENDPOINT_SUFFIX.as_posix()
        ))
        return 0

    if endpoint_hits and not version_match:
        print("UNKNOWN - vulnerable endpoint exists but affected version string '{}' was not confirmed".format(
            AFFECTED_VERSION
        ))
        return 2

    if version_match and not endpoint_hits:
        print("UNKNOWN - affected version string found but endpoint '{}' was not located".format(
            ENDPOINT_SUFFIX.as_posix()
        ))
        return 2

    print("UNKNOWN - insufficient evidence to confirm product, version, or endpoint")
    return 2


if __name__ == "__main__":
    try:
        sys.exit(main())
    except KeyboardInterrupt:
        print("UNKNOWN - interrupted")
        sys.exit(2)
    except Exception as exc:
        print(f"UNKNOWN - runtime error: {exc}")
        sys.exit(3)