A vulnerability was detected in xuxueli xxl-job up to 3

#!/usr/bin/env python3
# verify_xxl_job_cve_2026_3733.py
# Detect likely exposure to CVE-2026-3733 in xxl-job / xxl-job-admin deployments.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import re
import sys
import zipfile
from pathlib import Path

AFFECTED_MAX = (3, 3, 2)
NAME_HINTS = ("xxl-job", "xxl-job-admin", "xxl-job-core")
POM_PATH_HINT = "META-INF/maven"


def parse_version(text):
    m = re.search(r'(\d+)\.(\d+)\.(\d+)', text or '')
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def fmt(ver):
    return '.'.join(str(x) for x in ver) if ver else 'unknown'


def compare(v1, v2):
    return (v1 > v2) - (v1 < v2)


def candidate_files(root: Path):
    if root.is_file():
        return [root]
    found = []
    for p in root.rglob('*'):
        if p.is_file() and p.suffix.lower() in ('.jar', '.war'):
            if any(h in p.name.lower() for h in NAME_HINTS):
                found.append(p)
    return found


def version_from_filename(path: Path):
    return parse_version(path.name)


def version_from_zip(path: Path):
    try:
        with zipfile.ZipFile(path, 'r') as zf:
            # Prefer Maven pom.properties files
            for name in zf.namelist():
                low = name.lower()
                if POM_PATH_HINT.lower() in low and low.endswith('pom.properties') and any(h in low for h in NAME_HINTS):
                    data = zf.read(name).decode('utf-8', errors='ignore')
                    for line in data.splitlines():
                        if line.startswith('version='):
                            ver = parse_version(line.split('=', 1)[1].strip())
                            if ver:
                                return ver, f'{path}!{name}'
            # Fallback to MANIFEST or embedded path names
            for name in zf.namelist():
                low = name.lower()
                if low.endswith('manifest.mf'):
                    data = zf.read(name).decode('utf-8', errors='ignore')
                    for key in ('Implementation-Version:', 'Bundle-Version:', 'Specification-Version:'):
                        for line in data.splitlines():
                            if line.startswith(key):
                                ver = parse_version(line.split(':', 1)[1].strip())
                                if ver:
                                    return ver, f'{path}!{name}'
            # Last resort: infer from internal filenames
            for name in zf.namelist():
                if any(h in name.lower() for h in NAME_HINTS):
                    ver = parse_version(name)
                    if ver:
                        return ver, f'{path}!{name}'
    except Exception:
        return None, None
    return None, None


def inspect_path(target: Path):
    # Direct directories may contain pom.properties in exploded deployments
    if target.is_dir():
        for p in target.rglob('pom.properties'):
            low = str(p).lower()
            if POM_PATH_HINT.lower() in low and any(h in low for h in NAME_HINTS):
                try:
                    data = p.read_text(encoding='utf-8', errors='ignore')
                    for line in data.splitlines():
                        if line.startswith('version='):
                            ver = parse_version(line.split('=', 1)[1].strip())
                            if ver:
                                return ver, str(p)
                except Exception:
                    pass

    for f in candidate_files(target):
        ver, source = version_from_zip(f)
        if ver:
            return ver, source
        ver = version_from_filename(f)
        if ver:
            return ver, str(f)
    return None, None


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 verify_xxl_job_cve_2026_3733.py <path-to-app-dir-or-jar>')
        sys.exit(2)

    target = Path(sys.argv[1]).expanduser().resolve()
    if not target.exists():
        print(f'UNKNOWN - path not found: {target}')
        sys.exit(2)

    version, source = inspect_path(target)
    if not version:
        print('UNKNOWN - could not determine xxl-job version from files')
        sys.exit(2)

    if compare(version, AFFECTED_MAX) <= 0:
        print(f'VULNERABLE - detected xxl-job version {fmt(version)} from {source} (affected <= 3.3.2)')
        sys.exit(1)

    # No authoritative fixed-version statement was confirmed in the research set.
    # Versions above 3.3.2 are treated as PATCHED for operational triage, but validate against vendor guidance.
    print(f'PATCHED - detected xxl-job version {fmt(version)} from {source} (above affected range <= 3.3.2)')
    sys.exit(0)


if __name__ == '__main__':
    main()