Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft

#!/usr/bin/env python3
# check_cve_2026_35273.py
# Triage checker for CVE-2026-35273 (Oracle PeopleSoft PeopleTools Updates Environment Management)
# Exit codes:
#   0 = PATCHED / not in public affected major versions
#   1 = VULNERABLE / affected branch with PSEMHUB present
#   2 = UNKNOWN / insufficient evidence

import argparse
import os
import platform
import re
import shutil
import subprocess
import sys
from pathlib import Path

AFFECTED_MAJOR = {"8.61", "8.62"}


def eprint(msg):
    print(msg, file=sys.stderr)


def candidate_ps_homes(user_supplied=None):
    cands = []
    if user_supplied:
        cands.append(Path(user_supplied))
    for envvar in ("PS_HOME", "PSHOME"):
        val = os.environ.get(envvar)
        if val:
            cands.append(Path(val))
    common = []
    if os.name == "nt":
        common += [
            Path("C:/psft/pt"),
            Path("C:/oracle/psft/pt"),
            Path("D:/psft/pt"),
        ]
    else:
        common += [
            Path("/opt/psft/pt"),
            Path("/u01/app/psft/pt"),
            Path("/opt/oracle/psft/pt"),
        ]
    cands.extend(common)
    seen = []
    for c in cands:
        try:
            rc = c.resolve()
        except Exception:
            rc = c
        if rc not in seen:
            seen.append(rc)
    return seen


def find_psadmin(ps_home: Path):
    exe = "psadmin.exe" if os.name == "nt" else "psadmin"
    paths = [
        ps_home / "appserv" / exe,
        ps_home / "bin" / exe,
    ]
    for p in paths:
        if p.exists():
            return p
    found = shutil.which("psadmin")
    return Path(found) if found else None


def get_version_from_psadmin(psadmin_path: Path):
    try:
        proc = subprocess.run(
            [str(psadmin_path), "-v"],
            stdout=subprocess.PIPE,
            stderr=subprocess.STDOUT,
            text=True,
            timeout=20,
            check=False,
        )
        out = proc.stdout or ""
        m = re.search(r"Version\s+(\d+\.\d+)", out, re.IGNORECASE)
        if m:
            return m.group(1), out.strip()
        m = re.search(r"(8\.6[12])", out)
        if m:
            return m.group(1), out.strip()
        return None, out.strip()
    except Exception as exc:
        return None, f"psadmin execution failed: {exc}"


def find_psemhub(ps_home: Path):
    checks = [
        ps_home / "webserv",
        ps_home.parent / "webserv",
        ps_home.parent.parent / "webserv",
    ]
    matches = []
    for base in checks:
        if not base.exists():
            continue
        for pattern in [
            "**/PSEMHUB",
            "**/PSEMHUB.war",
            "**/applications/peoplesoft/PSEMHUB",
            "**/applications/peoplesoft/PSEMHUB.war",
        ]:
            try:
                matches.extend(base.glob(pattern))
            except Exception:
                pass
    uniq = []
    for m in matches:
        try:
            rm = m.resolve()
        except Exception:
            rm = m
        if rm not in uniq:
            uniq.append(rm)
    return uniq


def read_allowed_hosts(psemhub_paths):
    candidates = []
    for p in psemhub_paths:
        if p.is_dir():
            candidates.append(p / "envmetadata" / "config" / "allowedhost.properties")
            candidates.append(p / "WEB-INF" / "classes" / "envmetadata" / "config" / "allowedhost.properties")
        else:
            candidates.append(p.parent / "envmetadata" / "config" / "allowedhost.properties")
    for c in candidates:
        if c.exists():
            try:
                content = c.read_text(errors="ignore")
            except Exception:
                content = ""
            lines = []
            for line in content.splitlines():
                s = line.strip()
                if not s or s.startswith("#"):
                    continue
                lines.append(s)
            return str(c), lines
    return None, []


def main():
    parser = argparse.ArgumentParser(description="Triage check for CVE-2026-35273")
    parser.add_argument("--ps-home", help="Path to PS_HOME")
    args = parser.parse_args()

    version = None
    version_src = None
    ps_home_used = None
    psadmin_path = None

    for cand in candidate_ps_homes(args.ps_home):
        if not cand.exists():
            continue
        psadmin = find_psadmin(cand)
        if not psadmin:
            continue
        v, src = get_version_from_psadmin(psadmin)
        ps_home_used = cand
        psadmin_path = psadmin
        version = v
        version_src = src
        break

    if not ps_home_used:
        print("UNKNOWN: could not locate PS_HOME/psadmin; supply --ps-home explicitly")
        sys.exit(2)

    psemhub_paths = find_psemhub(ps_home_used)
    ah_path, ah_lines = read_allowed_hosts(psemhub_paths)

    details = {
        "host_os": platform.platform(),
        "ps_home": str(ps_home_used),
        "psadmin": str(psadmin_path) if psadmin_path else None,
        "version": version,
        "psemhub_found": [str(p) for p in psemhub_paths],
        "allowedhost_file": ah_path,
        "allowedhost_entries": ah_lines,
    }

    # Public logic only: Oracle publicly lists affected versions 8.61 and 8.62.
    # The public alert does not provide exact fixed build numbers, so this script
    # treats affected branches with deployed PSEMHUB as VULNERABLE for triage.
    if version in AFFECTED_MAJOR and psemhub_paths:
        print("VULNERABLE: affected PeopleTools branch with PSEMHUB deployed")
        print(details)
        sys.exit(1)
    elif version and version not in AFFECTED_MAJOR:
        print("PATCHED: installed PeopleTools major version is outside Oracle's public affected list (8.61/8.62)")
        print(details)
        sys.exit(0)
    else:
        print("UNKNOWN: could not confirm version or PSEMHUB deployment decisively")
        print(details)
        sys.exit(2)


if __name__ == "__main__":
    main()