Optimizely CMS weak password policy in EPiServer.CMS.UI before 12.32.0

#!/usr/bin/env python3
# verify_cve_2025_22390.py
# Detects whether an Optimizely CMS application references EPiServer.CMS.UI < 12.32.0
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/runtime error

import json
import os
import re
import sys
import xml.etree.ElementTree as ET

TARGET_PACKAGE = "episerver.cms.ui"
FIXED_VERSION = (12, 32, 0)
TEXT_FILE_NAMES = {
    "directory.packages.props",
    "packages.props",
}
JSON_FILE_SUFFIXES = (
    ".deps.json",
    "packages.lock.json",
    "project.assets.json",
)
XML_FILE_SUFFIXES = (
    ".csproj",
    ".props",
)


def normalize_version(v):
    if not v:
        return None
    v = v.strip()
    v = v.strip("[]()")
    if "," in v:
        v = v.split(",", 1)[0].strip()
    m = re.match(r"^(\d+)\.(\d+)\.(\d+)", v)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_to_str(t):
    return ".".join(str(x) for x in t) if t else "unknown"


def compare_versions(a, b):
    return (a > b) - (a < b)


def record(found, source, version):
    nv = normalize_version(version)
    if nv:
        found.append((source, nv, version))


def parse_json_file(path, found):
    try:
        with open(path, "r", encoding="utf-8", errors="ignore") as f:
            data = json.load(f)
    except Exception:
        return

    lower_name = os.path.basename(path).lower()

    if lower_name.endswith("packages.lock.json"):
        deps = data.get("dependencies", {})
        for framework, packages in deps.items():
            if isinstance(packages, dict):
                for pkg, meta in packages.items():
                    if pkg.lower() == TARGET_PACKAGE and isinstance(meta, dict):
                        record(found, path, meta.get("resolved") or meta.get("requested"))

    elif lower_name.endswith("project.assets.json"):
        libs = data.get("libraries", {})
        for key in libs.keys():
            if "/" in key:
                pkg, ver = key.split("/", 1)
                if pkg.lower() == TARGET_PACKAGE:
                    record(found, path, ver)
        targets = data.get("targets", {})
        for framework, packages in targets.items():
            if isinstance(packages, dict):
                for key in packages.keys():
                    if "/" in key:
                        pkg, ver = key.split("/", 1)
                        if pkg.lower() == TARGET_PACKAGE:
                            record(found, path, ver)

    elif lower_name.endswith(".deps.json"):
        libs = data.get("libraries", {})
        for key in libs.keys():
            if "/" in key:
                pkg, ver = key.split("/", 1)
                if pkg.lower() == TARGET_PACKAGE:
                    record(found, path, ver)


def strip_ns(tag):
    return tag.split("}", 1)[-1]


def parse_xml_file(path, found):
    try:
        tree = ET.parse(path)
        root = tree.getroot()
    except Exception:
        return

    for elem in root.iter():
        tag = strip_ns(elem.tag)
        if tag == "PackageReference":
            include = (elem.attrib.get("Include") or elem.attrib.get("Update") or "").strip()
            if include.lower() == TARGET_PACKAGE:
                version = elem.attrib.get("Version")
                if not version:
                    for child in elem:
                        if strip_ns(child.tag) == "Version" and child.text:
                            version = child.text.strip()
                            break
                record(found, path, version)


def parse_text_fallback(path, found):
    try:
        with open(path, "r", encoding="utf-8", errors="ignore") as f:
            text = f.read()
    except Exception:
        return

    patterns = [
        re.compile(r"<PackageReference[^>]+(?:Include|Update)=\"EPiServer\.CMS\.UI\"[^>]+Version=\"([^\"]+)\"", re.I),
        re.compile(r"<PackageVersion[^>]+Include=\"EPiServer\.CMS\.UI\"[^>]+Version=\"([^\"]+)\"", re.I),
        re.compile(r"EPiServer\.CMS\.UI\s*["']?\s*[:=]\s*["']([^"'\s<]+)", re.I),
    ]
    for pat in patterns:
        for m in pat.finditer(text):
            record(found, path, m.group(1))


def scan(root_path):
    found = []
    for dirpath, dirnames, filenames in os.walk(root_path):
        # keep scan reasonable
        dirnames[:] = [d for d in dirnames if d.lower() not in {".git", ".vs", "node_modules", "packages"}]
        for name in filenames:
            lower = name.lower()
            full = os.path.join(dirpath, name)
            if lower.endswith(JSON_FILE_SUFFIXES):
                parse_json_file(full, found)
            elif lower.endswith(XML_FILE_SUFFIXES):
                parse_xml_file(full, found)
                if lower in TEXT_FILE_NAMES or lower.endswith(".props"):
                    parse_text_fallback(full, found)
            elif lower in TEXT_FILE_NAMES:
                parse_text_fallback(full, found)
    return found


def main():
    if len(sys.argv) != 2:
        print("UNKNOWN - usage: python3 verify_cve_2025_22390.py <app_or_repo_path>")
        sys.exit(3)

    root_path = sys.argv[1]
    if not os.path.exists(root_path):
        print(f"UNKNOWN - path does not exist: {root_path}")
        sys.exit(3)

    found = scan(root_path)
    if not found:
        print("UNKNOWN - EPiServer.CMS.UI reference not found in scanned files")
        sys.exit(2)

    vulnerable = []
    patched = []
    for source, normalized, raw in found:
        if compare_versions(normalized, FIXED_VERSION) < 0:
            vulnerable.append((source, normalized, raw))
        else:
            patched.append((source, normalized, raw))

    # Prefer worst-case if conflicting references are present.
    if vulnerable:
        src, norm, raw = sorted(vulnerable, key=lambda x: x[1])[0]
        print(f"VULNERABLE - found EPiServer.CMS.UI {raw} in {src}; fixed version is {version_to_str(FIXED_VERSION)}+")
        sys.exit(1)

    src, norm, raw = sorted(patched, key=lambda x: x[1])[0]
    print(f"PATCHED - found EPiServer.CMS.UI {raw} in {src}; fixed version is {version_to_str(FIXED_VERSION)}+")
    sys.exit(0)


if __name__ == "__main__":
    main()