Optimizely EPiServer

#!/usr/bin/env python3
# verify_cve_2025_22389.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / could not determine

import json
import os
import re
import sys
import xml.etree.ElementTree as ET
from pathlib import Path

TARGET_PACKAGES = {
    'episerver.cms.ui',
    'episerver.cms.core',
    'episerver.cms'
}
FIXED = (12, 32, 0)


def normalize_name(name):
    return name.strip().lower()


def strip_prerelease(v):
    return re.split(r'[-+]', v, 1)[0]


def parse_version(v):
    if not v:
        return None
    v = v.strip()
    v = v.strip('[]()')
    v = strip_prerelease(v)
    m = re.match(r'^(\d+)\.(\d+)\.(\d+)', v)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_lt(a, b):
    return a < b


def add_hit(hits, pkg, ver, source):
    hits.append({'package': pkg, 'version': ver, 'source': source})


def scan_deps_json(path, hits):
    try:
        data = json.loads(path.read_text(encoding='utf-8', errors='ignore'))
    except Exception:
        return

    # Newer .NET deps layout
    libs = data.get('libraries', {})
    for key in libs.keys():
        # format usually: PackageName/Version
        if '/' in key:
            name, ver = key.split('/', 1)
            if normalize_name(name) in TARGET_PACKAGES:
                add_hit(hits, name, ver, str(path))

    # Fallback walk
    def walk(obj):
        if isinstance(obj, dict):
            for k, v in obj.items():
                if isinstance(k, str) and '/' in k:
                    name, ver = k.split('/', 1)
                    if normalize_name(name) in TARGET_PACKAGES:
                        add_hit(hits, name, ver, str(path))
                walk(v)
        elif isinstance(obj, list):
            for i in obj:
                walk(i)

    walk(data)


def scan_packages_lock(path, hits):
    try:
        data = json.loads(path.read_text(encoding='utf-8', errors='ignore'))
    except Exception:
        return

    deps = data.get('dependencies', {})
    for tfm, pkgs in deps.items():
        if isinstance(pkgs, dict):
            for name, meta in pkgs.items():
                if normalize_name(name) in TARGET_PACKAGES and isinstance(meta, dict):
                    ver = meta.get('resolved') or meta.get('version')
                    if ver:
                        add_hit(hits, name, ver, str(path))


def scan_packages_config(path, hits):
    try:
        root = ET.parse(path).getroot()
    except Exception:
        return
    for pkg in root.findall('.//package'):
        name = pkg.attrib.get('id', '')
        ver = pkg.attrib.get('version', '')
        if normalize_name(name) in TARGET_PACKAGES and ver:
            add_hit(hits, name, ver, str(path))


def scan_xml_project(path, hits):
    try:
        root = ET.parse(path).getroot()
    except Exception:
        return

    # Handle XML namespaces if present
    ns = ''
    if root.tag.startswith('{'):
        ns = root.tag.split('}')[0] + '}'

    # PackageReference entries
    for pr in root.findall(f'.//{ns}PackageReference'):
        name = pr.attrib.get('Include') or pr.attrib.get('Update') or ''
        ver = pr.attrib.get('Version', '')
        if not ver:
            version_elem = pr.find(f'{ns}Version')
            if version_elem is not None and version_elem.text:
                ver = version_elem.text.strip()
        if normalize_name(name) in TARGET_PACKAGES and ver:
            add_hit(hits, name, ver, str(path))

    # Central package management entries
    for pv in root.findall(f'.//{ns}PackageVersion'):
        name = pv.attrib.get('Include') or ''
        ver = pv.attrib.get('Version', '')
        if normalize_name(name) in TARGET_PACKAGES and ver:
            add_hit(hits, name, ver, str(path))


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN: usage: python3 verify_cve_2025_22389.py /path/to/app')
        sys.exit(2)

    base = Path(sys.argv[1])
    if not base.exists():
        print(f'UNKNOWN: path not found: {base}')
        sys.exit(2)

    hits = []
    patterns = ['*.deps.json', 'packages.lock.json', 'packages.config', '*.csproj', 'Directory.Packages.props']

    for pattern in patterns:
        for path in base.rglob(pattern):
            name = path.name.lower()
            if name.endswith('.deps.json'):
                scan_deps_json(path, hits)
            elif name == 'packages.lock.json':
                scan_packages_lock(path, hits)
            elif name == 'packages.config':
                scan_packages_config(path, hits)
            elif name.endswith('.csproj') or name == 'directory.packages.props':
                scan_xml_project(path, hits)

    if not hits:
        print('UNKNOWN: no Optimizely CMS package references found')
        sys.exit(2)

    parsed = []
    for h in hits:
        pv = parse_version(h['version'])
        if pv is not None:
            parsed.append((pv, h))

    if not parsed:
        print('UNKNOWN: Optimizely packages found, but versions were not parseable')
        for h in hits:
            print(f"  {h['package']} {h['version']} @ {h['source']}")
        sys.exit(2)

    vulnerable = [h for pv, h in parsed if version_lt(pv, FIXED)]
    patched = [h for pv, h in parsed if not version_lt(pv, FIXED)]

    # Prefer vulnerable if any in-scope package is below fixed version
    if vulnerable:
        print('VULNERABLE: found Optimizely CMS package versions below 12.32.0')
        for h in vulnerable:
            print(f"  {h['package']} {h['version']} @ {h['source']}")
        sys.exit(1)

    if patched:
        print('PATCHED: found Optimizely CMS package versions at or above 12.32.0')
        for h in patched:
            print(f"  {h['package']} {h['version']} @ {h['source']}")
        sys.exit(0)

    print('UNKNOWN: package references found but state could not be determined')
    sys.exit(2)


if __name__ == '__main__':
    main()