Optimizely Configured Commerce session tokens remain valid after logout

#!/usr/bin/env python3
# check_cve_2025_22386.py
# Determine whether an Optimizely Configured Commerce version is affected by CVE-2025-22386.
# Exit codes:
#   0 = all checked assets are PATCHED
#   1 = one or more assets are VULNERABLE
#   2 = UNKNOWN / input error

import argparse
import csv
import re
import sys
from typing import Optional, Tuple

FIXED = (5, 2, 2408)


def parse_version(v: str) -> Optional[Tuple[int, int, int]]:
    if v is None:
        return None
    s = v.strip()
    # Accept values like 5.2.2408, v5.2.2408, 5.2.2408 (STS), 5.2.2408-LTS
    m = re.search(r'(\d+)\.(\d+)\.(\d+)', s)
    if not m:
        return None
    try:
        return tuple(int(x) for x in m.groups())
    except ValueError:
        return None


def status_for_version(v: str) -> str:
    parsed = parse_version(v)
    if parsed is None:
        return 'UNKNOWN'
    if parsed < FIXED:
        return 'VULNERABLE'
    return 'PATCHED'


def check_single(version: str) -> int:
    status = status_for_version(version)
    print(status)
    return 1 if status == 'VULNERABLE' else 0 if status == 'PATCHED' else 2


def check_csv(path: str, column: str) -> int:
    overall = 0
    seen = 0
    try:
        with open(path, newline='', encoding='utf-8-sig') as f:
            reader = csv.DictReader(f)
            if column not in (reader.fieldnames or []):
                print(f'UNKNOWN: column "{column}" not found in CSV header', file=sys.stderr)
                return 2
            for row in reader:
                seen += 1
                version = row.get(column, '')
                asset = row.get('asset') or row.get('hostname') or row.get('name') or f'row-{seen}'
                status = status_for_version(version)
                print(f'{asset}: {status} ({version})')
                if status == 'VULNERABLE':
                    overall = 1
                elif status == 'UNKNOWN' and overall == 0:
                    overall = 2
    except FileNotFoundError:
        print(f'UNKNOWN: file not found: {path}', file=sys.stderr)
        return 2
    except Exception as e:
        print(f'UNKNOWN: failed to read CSV: {e}', file=sys.stderr)
        return 2

    if seen == 0:
        print('UNKNOWN: CSV contained no rows', file=sys.stderr)
        return 2
    return overall


def main() -> int:
    parser = argparse.ArgumentParser(description='Check Optimizely Configured Commerce versions for CVE-2025-22386')
    group = parser.add_mutually_exclusive_group(required=True)
    group.add_argument('--version', help='Single Configured Commerce version, e.g. 5.2.2407')
    group.add_argument('--csv', help='CSV file containing asset inventory')
    parser.add_argument('--column', default='version', help='CSV column name holding the version (default: version)')
    args = parser.parse_args()

    if args.version:
        return check_single(args.version)
    return check_csv(args.csv, args.column)


if __name__ == '__main__':
    sys.exit(main())