Unity Runtime before 2025-10-02 on Android

#!/usr/bin/env python3
# check_unity_cve_2025_59489.py
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/runtime error

import argparse
import csv
import re
import sys
from typing import Optional, Tuple

# First fixed versions from Unity advisory for supported branches.
FIXED = {
    "2019.1": "2019.1.15f1",
    "2019.2": "2019.2.23f1",
    "2019.3": "2019.3.17f1",
    "2019.4": "2019.4.41f1",
    "2020.1": "2020.1.18f1",
    "2020.2": "2020.2.8f1",
    "2020.3": "2020.3.49f1",
    "2021.1": "2021.1.29f1",
    "2021.2": "2021.2.20f1",
    "2021.3": "2021.3.45f2",
    "2022.1": "2022.1.25f1",
    "2022.2": "2022.2.23f1",
    "2022.3": "2022.3.62f2",
    "2023.1": "2023.1.22f1",
    "2023.2": "2023.2.22f1",
    "6000.0": "6000.0.58f2",
    "6000.1": "6000.1.17f1",
    "6000.2": "6000.2.6f2",
    "6000.3": "6000.3.0b4",
}

# Legacy lines noted by Unity as affected but with N/A editor patched versions.
# Version-only checking cannot prove binary-patch status, so these are conservatively VULNERABLE.
LEGACY_VULN_PREFIXES = [
    "2017.1",
    "2017.2",
    "2017.3",
    "2017.4",
    "2018.1",
    "2018.2",
    "2018.3",
    "2018.4",
]

VER_RE = re.compile(r"^(\d+)\.(\d+)\.(\d+)([abfp])(\d+)$")
SUFFIX_ORDER = {"a": 0, "b": 1, "f": 2, "p": 3}


def parse_version(v: str) -> Optional[Tuple[int, int, int, int, int]]:
    v = v.strip()
    m = VER_RE.match(v)
    if not m:
        return None
    major, minor, patch, suffix, suffix_num = m.groups()
    return (int(major), int(minor), int(patch), SUFFIX_ORDER[suffix], int(suffix_num))


def branch_of(v: str) -> Optional[str]:
    m = re.match(r"^(\d+)\.(\d+)\.", v.strip())
    if not m:
        return None
    return f"{m.group(1)}.{m.group(2)}"


def compare_versions(a: str, b: str) -> Optional[int]:
    pa = parse_version(a)
    pb = parse_version(b)
    if pa is None or pb is None:
        return None
    return (pa > pb) - (pa < pb)


def assess(version: str) -> Tuple[str, str]:
    version = version.strip()
    branch = branch_of(version)
    if not branch:
        return ("UNKNOWN", f"Unrecognized Unity version format: {version}")

    if branch in LEGACY_VULN_PREFIXES:
        return (
            "VULNERABLE",
            f"{version} is in legacy affected branch {branch}; Unity lists no editor patched version (N/A). Assume vulnerable unless you have explicit proof of runtime binary patching or rebuilt application.",
        )

    fixed = FIXED.get(branch)
    if not fixed:
        return (
            "UNKNOWN",
            f"Branch {branch} is not in the built-in advisory map. Check the Unity advisory manually.",
        )

    cmp_res = compare_versions(version, fixed)
    if cmp_res is None:
        return ("UNKNOWN", f"Could not compare {version} to fixed version {fixed}")
    if cmp_res < 0:
        return ("VULNERABLE", f"{version} is older than fixed version {fixed} for branch {branch}")
    return ("PATCHED", f"{version} is at or newer than fixed version {fixed} for branch {branch}")


def process_single(version: str) -> int:
    status, detail = assess(version)
    print(status)
    print(detail)
    return {"PATCHED": 0, "VULNERABLE": 1, "UNKNOWN": 2}[status]


def process_csv(path: str, column: str) -> int:
    worst = 0
    seen = 0
    with open(path, newline="", encoding="utf-8-sig") as fh:
        reader = csv.DictReader(fh)
        if column not in reader.fieldnames:
            print("UNKNOWN")
            print(f"CSV missing required column: {column}")
            return 2
        for row in reader:
            seen += 1
            version = (row.get(column) or "").strip()
            asset = row.get("asset") or row.get("name") or row.get("app") or f"row-{seen}"
            if not version:
                status, detail = ("UNKNOWN", "No Unity version present")
            else:
                status, detail = assess(version)
            print(f"{asset},{version},{status},{detail}")
            rc = {"PATCHED": 0, "VULNERABLE": 1, "UNKNOWN": 2}[status]
            worst = max(worst, rc)
    if seen == 0:
        print("UNKNOWN")
        print("CSV contained no rows")
        return 2
    print(["PATCHED", "VULNERABLE", "UNKNOWN"][worst if worst < 3 else 2])
    return worst


def main() -> int:
    parser = argparse.ArgumentParser(description="Check Unity versions for CVE-2025-59489 exposure")
    group = parser.add_mutually_exclusive_group(required=True)
    group.add_argument("--version", help="Single Unity version, e.g. 2022.3.61f1")
    group.add_argument("--csv", help="CSV file with Unity versions")
    parser.add_argument("--column", default="unity_version", help="CSV column name for the Unity version (default: unity_version)")
    args = parser.parse_args()

    try:
        if args.version:
            return process_single(args.version)
        return process_csv(args.csv, args.column)
    except FileNotFoundError as e:
        print("UNKNOWN")
        print(f"File not found: {e}")
        return 3
    except Exception as e:
        print("UNKNOWN")
        print(f"Runtime error: {e}")
        return 3


if __name__ == "__main__":
    sys.exit(main())