SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability

#!/usr/bin/env python3
# CVE-2026-28299 local version check for SolarWinds Web Help Desk
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1=vulnerable, 0=patched, 2=unknown

import argparse
import os
import platform
import re
import sys
from typing import List, Optional, Tuple

FIXED = (2026, 2)
VERSION_RE = re.compile(r'\b(20\d{2})\.(\d+)\b')
TEXT_EXTS = {'.txt', '.log', '.cfg', '.conf', '.ini', '.xml', '.json', '.properties', '.yml', '.yaml', '.html', '.htm', '.md'}
FILE_HINTS = {
    'version', 'release', 'readme', 'build', 'manifest', 'application.properties',
    'wrapper.conf', 'whd.env', 'package.json'
}


def normpath(p: str) -> str:
    return os.path.abspath(os.path.expanduser(p))


def default_roots() -> List[str]:
    system = platform.system().lower()
    roots = []
    if system == 'windows':
        roots.extend([
            r'C:\Program Files\WebHelpDesk',
            r'C:\Program Files\SolarWinds\WebHelpDesk',
            r'C:\Program Files (x86)\WebHelpDesk',
            r'C:\Program Files (x86)\SolarWinds\WebHelpDesk',
        ])
    elif system == 'darwin':
        roots.extend([
            '/Applications/WebHelpDesk.app/Contents/Resources',
            '/usr/local/webhelpdesk',
            '/opt/webhelpdesk',
            '/usr/local/solarwinds/webhelpdesk',
        ])
    else:
        roots.extend([
            '/opt/webhelpdesk',
            '/usr/local/webhelpdesk',
            '/opt/solarwinds/webhelpdesk',
            '/usr/local/solarwinds/webhelpdesk',
        ])
    return [r for r in roots if os.path.exists(r)]


def parse_version_tuple(s: str) -> Optional[Tuple[int, int]]:
    m = VERSION_RE.search(s)
    if not m:
        return None
    return int(m.group(1)), int(m.group(2))


def compare_versions(a: Tuple[int, int], b: Tuple[int, int]) -> int:
    return (a > b) - (a < b)


def should_read_file(path: str) -> bool:
    base = os.path.basename(path).lower()
    ext = os.path.splitext(base)[1].lower()
    if ext in TEXT_EXTS:
        return True
    return any(h in base for h in FILE_HINTS)


def candidate_files(root: str, max_depth: int = 3) -> List[str]:
    out = []
    root = normpath(root)
    for cur, dirs, files in os.walk(root):
        rel = os.path.relpath(cur, root)
        depth = 0 if rel == '.' else rel.count(os.sep) + 1
        if depth > max_depth:
            dirs[:] = []
            continue
        for name in files:
            p = os.path.join(cur, name)
            try:
                if should_read_file(p) and os.path.getsize(p) <= 2 * 1024 * 1024:
                    out.append(p)
            except OSError:
                pass
    return out


def extract_versions_from_file(path: str) -> List[Tuple[int, int, str]]:
    found = []
    try:
        with open(path, 'r', encoding='utf-8', errors='ignore') as f:
            data = f.read()
    except Exception:
        return found
    for m in VERSION_RE.finditer(data):
        year = int(m.group(1))
        minor = int(m.group(2))
        found.append((year, minor, path))
    return found


def assess_root(root: str) -> Tuple[str, str]:
    root = normpath(root)
    if not os.path.exists(root):
        return 'UNKNOWN', f'Path does not exist: {root}'

    versions = []
    for path in candidate_files(root):
        versions.extend(extract_versions_from_file(path))

    # Prefer explicit WHD 20xx.x style versions from nearby files
    versions = sorted(set(versions))
    if versions:
        # Choose the highest discovered version as the most likely installed version
        highest = max((v[:2] for v in versions), key=lambda x: (x[0], x[1]))
        evidence = [v for v in versions if v[0] == highest[0] and v[1] == highest[1]][:3]
        if compare_versions(highest, FIXED) >= 0:
            src = '; '.join(x[2] for x in evidence)
            return 'PATCHED', f'Detected WHD version {highest[0]}.{highest[1]} (evidence: {src})'
        else:
            src = '; '.join(x[2] for x in evidence)
            return 'VULNERABLE', f'Detected WHD version {highest[0]}.{highest[1]} which is earlier than 2026.2 (evidence: {src})'

    # Heuristic fallback: Caddy 2.11.1 presence strongly suggests 2026.2+, but keep UNKNOWN if no explicit WHD version found.
    caddy_hits = []
    for path in candidate_files(root, max_depth=4):
        try:
            with open(path, 'r', encoding='utf-8', errors='ignore') as f:
                sample = f.read(200000)
            if 'Caddy 2.11.1' in sample or 'caddy 2.11.1' in sample.lower():
                caddy_hits.append(path)
        except Exception:
            pass
    if caddy_hits:
        return 'UNKNOWN', 'Found references to Caddy 2.11.1, which aligns with WHD 2026.2 documentation, but no explicit installed WHD version string was located.'

    return 'UNKNOWN', 'Could not determine the installed WHD version from local files. Re-run with --root pointing to the exact WHD install directory.'


def main() -> int:
    parser = argparse.ArgumentParser(description='Check SolarWinds Web Help Desk for CVE-2026-28299 exposure by local version.')
    parser.add_argument('--root', action='append', help='WHD install root path. Can be supplied multiple times.')
    args = parser.parse_args()

    roots = [normpath(r) for r in (args.root or [])]
    if not roots:
        roots = default_roots()

    if not roots:
        print('UNKNOWN - No candidate WHD install paths found. Supply --root explicitly.')
        return 2

    overall = []
    for root in roots:
        status, detail = assess_root(root)
        overall.append((status, root, detail))

    # Precedence: VULNERABLE > PATCHED > UNKNOWN
    for status in ('VULNERABLE', 'PATCHED', 'UNKNOWN'):
        matches = [x for x in overall if x[0] == status]
        if matches:
            chosen = matches[0]
            print(f'{status} - {chosen[2]}')
            if status == 'VULNERABLE':
                return 1
            if status == 'PATCHED':
                return 0
            return 2

    print('UNKNOWN - Unexpected state')
    return 2


if __name__ == '__main__':
    sys.exit(main())