Optimizely EPiServer

#!/usr/bin/env python3
# check_optimizely_cve_2025_22388.py
# Detects whether a deployed/app source tree appears to use EPiServer.CMS.Core < 12.22.0
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=USAGE ERROR

import json
import os
import re
import sys
import xml.etree.ElementTree as ET
from pathlib import Path

FIXED = (12, 22, 0)
PKG = 'episerver.cms.core'


def parse_version(v):
    if not v:
        return None
    v = v.strip()
    v = re.sub(r'^[\[\(\s]*', '', v)
    v = re.sub(r'[\]\)\s]*$', '', v)
    v = v.split(',')[0].strip()
    m = re.match(r'^(\d+)\.(\d+)\.(\d+)', v)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def fmt(ver):
    return '.'.join(str(x) for x in ver)


def is_vulnerable(ver):
    return ver is not None and ver < FIXED


def scan_deps_json(path):
    findings = []
    try:
        data = json.loads(path.read_text(encoding='utf-8', errors='ignore'))
    except Exception:
        return findings

    for section in ('libraries', 'targets'):
        obj = data.get(section, {})
        if not isinstance(obj, dict):
            continue
        stack = [obj]
        while stack:
            cur = stack.pop()
            if isinstance(cur, dict):
                for k, v in cur.items():
                    lk = str(k).lower()
                    if lk.startswith(PKG + '/'):
                        ver = parse_version(lk.split('/', 1)[1])
                        if ver:
                            findings.append((str(path), ver, 'deps.json'))
                    if isinstance(v, (dict, list)):
                        stack.append(v)
            elif isinstance(cur, list):
                for item in cur:
                    if isinstance(item, (dict, list)):
                        stack.append(item)
    return findings


def scan_csproj(path):
    findings = []
    try:
        root = ET.parse(path).getroot()
    except Exception:
        return findings

    for elem in root.iter():
        if elem.tag.lower().endswith('packagereference'):
            include = (elem.attrib.get('Include') or elem.attrib.get('Update') or '').strip().lower()
            if include == PKG:
                ver = elem.attrib.get('Version') or ''
                if not ver:
                    for child in elem:
                        if child.tag.lower().endswith('version') and child.text:
                            ver = child.text
                            break
                pver = parse_version(ver)
                if pver:
                    findings.append((str(path), pver, 'csproj'))
    return findings


def scan_packages_config(path):
    findings = []
    try:
        root = ET.parse(path).getroot()
    except Exception:
        return findings

    for pkg in root.findall('.//package'):
        pkg_id = (pkg.attrib.get('id') or '').strip().lower()
        if pkg_id == PKG:
            ver = parse_version(pkg.attrib.get('version'))
            if ver:
                findings.append((str(path), ver, 'packages.config'))
    return findings


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python check_optimizely_cve_2025_22388.py <path>')
        sys.exit(3)

    base = Path(sys.argv[1])
    if not base.exists():
        print(f'UNKNOWN - path does not exist: {base}')
        sys.exit(2)

    findings = []
    for root, dirs, files in os.walk(base):
        # Skip common heavy/unhelpful trees
        dirs[:] = [d for d in dirs if d.lower() not in {'.git', 'node_modules', '.vs', 'bin', 'obj'}]
        for name in files:
            p = Path(root) / name
            lname = name.lower()
            if lname.endswith('.deps.json'):
                findings.extend(scan_deps_json(p))
            elif lname.endswith('.csproj'):
                findings.extend(scan_csproj(p))
            elif lname == 'packages.config':
                findings.extend(scan_packages_config(p))

    if not findings:
        print('UNKNOWN - could not locate EPiServer.CMS.Core version in .deps.json, .csproj, or packages.config')
        sys.exit(2)

    # Choose the highest discovered version as the most useful signal in mixed trees
    best = max(findings, key=lambda x: x[1])
    vuln_hits = [f for f in findings if is_vulnerable(f[1])]

    if vuln_hits:
        worst = min(vuln_hits, key=lambda x: x[1])
        print(f'VULNERABLE - found {PKG} {fmt(worst[1])} in {worst[0]} via {worst[2]}; fixed version is {fmt(FIXED)}')
        sys.exit(1)

    print(f'PATCHED - highest discovered {PKG} version is {fmt(best[1])}; fixed threshold is {fmt(FIXED)}')
    sys.exit(0)


if __name__ == '__main__':
    main()