Optimizely Configured Commerce before 5

# check-cve-2025-22384.ps1

# Defensive validation helper for CVE-2025-22384 / Optimizely Configured Commerce

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=ERROR


param(
    [Parameter(Mandatory=$true)]
    [string]$Root,

    [string]$FixedVersion = '5.2.2408'
)

function Write-Result {
    param(
        [string]$State,
        [string]$Message,
        [int]$Code
    )
    Write-Output "$State - $Message"
    exit $Code
}

function Normalize-VersionParts {
    param([string]$Version)
    if ([string]::IsNullOrWhiteSpace($Version)) { return $null }

    $clean = ($Version -replace '[^0-9\.]', '')
    if ([string]::IsNullOrWhiteSpace($clean)) { return $null }

    $parts = $clean.Split('.') | Where-Object { $_ -ne '' }
    if ($parts.Count -lt 3) { return $null }

    $nums = @()
    foreach ($p in $parts) {
        try { $nums += [int]$p } catch { return $null }
    }
    return ,$nums
}

function Compare-Version {
    param(
        [string]$A,
        [string]$B
    )
    $va = Normalize-VersionParts $A
    $vb = Normalize-VersionParts $B
    if ($null -eq $va -or $null -eq $vb) { return $null }

    $max = [Math]::Max($va.Count, $vb.Count)
    for ($i = 0; $i -lt $max; $i++) {
        $ai = if ($i -lt $va.Count) { $va[$i] } else { 0 }
        $bi = if ($i -lt $vb.Count) { $vb[$i] } else { 0 }
        if ($ai -gt $bi) { return 1 }
        if ($ai -lt $bi) { return -1 }
    }
    return 0
}

function Get-CandidateVersionStrings {
    param([string]$Path)

    $found = New-Object System.Collections.Generic.List[string]

    # 1) Inspect DLL/EXE metadata for Optimizely/Insite-related assemblies

    $bins = @(
        (Join-Path $Path 'bin'),
        (Join-Path $Path 'wwwroot\\bin')
    ) | Where-Object { Test-Path $_ }

    foreach ($bin in $bins) {
        Get-ChildItem -Path $bin -Recurse -Include *.dll,*.exe -ErrorAction SilentlyContinue | ForEach-Object {
            try {
                $vi = $_.VersionInfo
                $nameBlob = @($vi.ProductName, $vi.FileDescription, $_.Name) -join ' '
                if ($nameBlob -match '(Optimizely|Configured Commerce|Insite)') {
                    foreach ($cand in @($vi.ProductVersion, $vi.FileVersion)) {
                        if (-not [string]::IsNullOrWhiteSpace($cand)) {
                            $found.Add($cand)
                        }
                    }
                }
            } catch {}
        }
    }

    # 2) Grep common config/text files for explicit version strings

    Get-ChildItem -Path $Path -Recurse -Include web.config,appsettings*.json,*.config,*.txt -ErrorAction SilentlyContinue | ForEach-Object {
        try {
            $matches = Select-String -Path $_.FullName -Pattern '(?i)(version|configured\s*commerce|optimizely|insite)[^\r\n]{0,80}(\d+\.\d+\.\d+)' -AllMatches -ErrorAction SilentlyContinue
            foreach ($m in $matches) {
                foreach ($g in $m.Matches) {
                    if ($g.Groups.Count -ge 3) {
                        $found.Add($g.Groups[2].Value)
                    }
                }
            }
        } catch {}
    }

    return $found
}

try {
    if (-not (Test-Path $Root)) {
        Write-Result 'UNKNOWN' "Path not found: $Root" 2
    }

    $candidates = Get-CandidateVersionStrings -Path $Root | Select-Object -Unique
    if (-not $candidates -or $candidates.Count -eq 0) {
        Write-Result 'UNKNOWN' 'No Optimizely Configured Commerce version evidence found in file metadata or config text.' 2
    }

    $normalized = @()
    foreach ($c in $candidates) {
        if ($null -ne (Normalize-VersionParts $c)) {
            $normalized += $c
        }
    }

    if (-not $normalized -or $normalized.Count -eq 0) {
        Write-Result 'UNKNOWN' 'Version-like strings were found, but none were parseable as product versions.' 2
    }

    # Pick the highest parseable version we can find

    $highest = $normalized[0]
    foreach ($v in $normalized) {
        $cmp = Compare-Version -A $v -B $highest
        if ($cmp -eq 1) { $highest = $v }
    }

    $finalCmp = Compare-Version -A $highest -B $FixedVersion
    if ($null -eq $finalCmp) {
        Write-Result 'UNKNOWN' "Unable to compare discovered version '$highest' to fixed version '$FixedVersion'." 2
    }

    if ($finalCmp -ge 0) {
        Write-Result 'PATCHED' "Discovered version '$highest' is at or above fixed version '$FixedVersion'." 0
    } else {
        Write-Result 'VULNERABLE' "Discovered version '$highest' is below fixed version '$FixedVersion'." 1
    }
}
catch {
    Write-Result 'UNKNOWN' ("Unhandled error: " + $_.Exception.Message) 3
}