Cross-site request forgery vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE…

#!/usr/bin/env python3
# check_musetheque_cve_2026_28761.py
# Purpose: best-effort version check for CVE-2026-28761
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/runtime error

import argparse
import os
import re
import sys
from urllib.request import Request, urlopen
from urllib.error import URLError, HTTPError

VULN_MAX = (2203, 0)   # rev2203.0 and earlier vulnerable
PATCH_MIN = (2603, 1)  # rev2603.1 fixed per JVN
VERSION_RE = re.compile(r'rev\s*(\d{4})\.(\d+)', re.IGNORECASE)
TARGET_HINTS = [
    'Musetheque',
    'IPKNOWLEDGE',
    'Musetheque V4',
    '情報公開 for IPKNOWLEDGE'
]


def parse_rev(text):
    matches = VERSION_RE.findall(text or '')
    versions = []
    for major, minor in matches:
        try:
            versions.append((int(major), int(minor)))
        except ValueError:
            pass
    return versions


def classify(versions):
    if not versions:
        return None
    # If any explicitly patched version is present, treat as patched.
    for v in versions:
        if v >= PATCH_MIN:
            return 'PATCHED'
    # Otherwise if any vulnerable version is present, treat as vulnerable.
    for v in versions:
        if v <= VULN_MAX:
            return 'VULNERABLE'
    return 'UNKNOWN'


def scan_file(path):
    try:
        if os.path.getsize(path) > 5 * 1024 * 1024:
            return []
        with open(path, 'rb') as f:
            data = f.read()
        text = data.decode('utf-8', errors='ignore')
        return parse_rev(text)
    except Exception:
        return []


def scan_path(root):
    found_versions = []
    hints_seen = False
    for dirpath, _, filenames in os.walk(root):
        for name in filenames:
            full = os.path.join(dirpath, name)
            lowered = name.lower()
            if any(k.lower() in lowered for k in ['musetheque', 'ipknowledge', 'version', 'about', 'manifest', 'readme', 'release']):
                hints_seen = True
            versions = scan_file(full)
            if versions:
                found_versions.extend(versions)
                hints_seen = True
    return hints_seen, found_versions


def fetch_url(url):
    req = Request(url, headers={'User-Agent': 'Mozilla/5.0 noisgate-version-check'})
    with urlopen(req, timeout=10) as resp:
        raw = resp.read(1024 * 1024)
        return raw.decode('utf-8', errors='ignore')


def scan_url(base_url):
    candidates = [
        base_url,
        base_url.rstrip('/') + '/login',
        base_url.rstrip('/') + '/index.html',
        base_url.rstrip('/') + '/about',
    ]
    versions = []
    target_hints = False
    for u in candidates:
        try:
            text = fetch_url(u)
            if any(h in text for h in TARGET_HINTS):
                target_hints = True
            versions.extend(parse_rev(text))
        except (URLError, HTTPError, TimeoutError, ValueError):
            continue
    return target_hints, versions


def print_result(result, detail=''):
    if detail:
        print(f'{result}: {detail}')
    else:
        print(result)
    if result == 'PATCHED':
        sys.exit(0)
    if result == 'VULNERABLE':
        sys.exit(1)
    if result == 'UNKNOWN':
        sys.exit(2)
    sys.exit(3)


def main():
    parser = argparse.ArgumentParser(description='Best-effort checker for CVE-2026-28761 in Musetheque V4 Information Disclosure for IPKNOWLEDGE')
    group = parser.add_mutually_exclusive_group(required=True)
    group.add_argument('--path', help='Local installation directory to scan')
    group.add_argument('--url', help='Base URL of the web application')
    args = parser.parse_args()

    if args.path:
        if not os.path.isdir(args.path):
            print_result('UNKNOWN', f'path not found or not a directory: {args.path}')
        hints_seen, versions = scan_path(args.path)
        result = classify(versions)
        if result:
            vers = ', '.join([f'rev{a}.{b}' for a, b in sorted(set(versions))])
            print_result(result, f'local version markers found: {vers}')
        if hints_seen:
            print_result('UNKNOWN', 'installation artifacts found but no decisive version string was located')
        print_result('UNKNOWN', 'no Musetheque/IPKNOWLEDGE-specific artifacts or version markers were located')

    if args.url:
        hints_seen, versions = scan_url(args.url)
        result = classify(versions)
        if result:
            vers = ', '.join([f'rev{a}.{b}' for a, b in sorted(set(versions))])
            print_result(result, f'web-exposed version markers found: {vers}')
        if hints_seen:
            print_result('UNKNOWN', 'target appears to be Musetheque/IPKNOWLEDGE but no decisive version string was exposed')
        print_result('UNKNOWN', 'could not confirm target identity or version from HTTP responses')


if __name__ == '__main__':
    main()