IBM WebSphere Application Server - Liberty 19

#!/usr/bin/env python3
# CVE-2026-4410 verification helper
# Outputs exactly one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1=vulnerable, 0=patched/not affected, 2=unknown

import argparse
import os
import platform
import re
import subprocess
import sys
from pathlib import Path


def parse_ver(v):
    try:
        return tuple(int(x) for x in v.strip().split('.'))
    except Exception:
        return None


def cmp_ver(a, b):
    la = list(a)
    lb = list(b)
    while len(la) < len(lb):
        la.append(0)
    while len(lb) < len(la):
        lb.append(0)
    return (tuple(la) > tuple(lb)) - (tuple(la) < tuple(lb))


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, timeout=30)
        return p.returncode, p.stdout
    except Exception:
        return None, ''


def find_version_in_text(text):
    patterns = [
        r'\b(\d+\.\d+\.\d+\.\d+)\b',
        r'Version\s*[=:]?\s*(\d+\.\d+\.\d+\.\d+)',
        r'\b(\d+\.\d+\.\d+)\b'
    ]
    for pat in patterns:
        m = re.search(pat, text, re.IGNORECASE)
        if m:
            return m.group(1)
    return None


def detect_liberty(install_root):
    return (install_root / 'bin' / 'productInfo').exists() or (install_root / 'bin' / 'productInfo.bat').exists() or install_root.name.lower() == 'wlp'


def get_liberty_version(install_root):
    candidates = [install_root / 'bin' / 'productInfo', install_root / 'bin' / 'productInfo.bat']
    for c in candidates:
        if c.exists():
            cmd = [str(c), 'version']
            if c.suffix.lower() == '.bat':
                cmd = ['cmd', '/c'] + cmd
            rc, out = run_cmd(cmd)
            v = find_version_in_text(out)
            if v:
                return v
    for rel in [Path('lib/versions/openliberty.properties'), Path('lib/versions/WebSphereApplicationServer.properties')]:
        p = install_root / rel
        if p.exists():
            try:
                data = p.read_text(errors='ignore')
                m = re.search(r'\bversion\s*[=:]\s*(\d+\.\d+\.\d+\.\d+)\b', data, re.IGNORECASE)
                if m:
                    return m.group(1)
            except Exception:
                pass
    return None


def get_traditional_version(install_root):
    candidates = [install_root / 'bin' / 'versionInfo.sh', install_root / 'bin' / 'versionInfo.bat']
    for c in candidates:
        if c.exists():
            cmd = [str(c)]
            if c.suffix.lower() == '.bat':
                cmd = ['cmd', '/c'] + cmd
            rc, out = run_cmd(cmd)
            v = find_version_in_text(out)
            if v:
                return v
    return None


def find_server_xmls(install_root, explicit_server_xml=None):
    results = []
    if explicit_server_xml:
        p = Path(explicit_server_xml)
        if p.exists():
            results.append(p)
        return results
    for base in [install_root / 'usr' / 'servers', install_root / 'usrServers', install_root / 'servers']:
        if base.exists():
            for p in base.rglob('server.xml'):
                results.append(p)
    return results


def liberty_sip_enabled(server_xmls):
    if not server_xmls:
        return None
    for p in server_xmls:
        try:
            data = p.read_text(errors='ignore')
            if 'sipServlet-1.1' in data:
                return True
        except Exception:
            continue
    return False


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument('--install-root', required=True, help='WebSphere/Liberty install root')
    ap.add_argument('--server-xml', help='Liberty server.xml path (optional but recommended for Liberty)')
    args = ap.parse_args()

    root = Path(args.install_root)
    if not root.exists():
        print('UNKNOWN')
        sys.exit(2)

    if detect_liberty(root):
        version = get_liberty_version(root)
        if not version:
            print('UNKNOWN')
            sys.exit(2)
        pv = parse_ver(version)
        if not pv:
            print('UNKNOWN')
            sys.exit(2)

        xmls = find_server_xmls(root, args.server_xml)
        sip = liberty_sip_enabled(xmls)
        if sip is None:
            print('UNKNOWN')
            sys.exit(2)
        if sip is False:
            print('PATCHED')
            sys.exit(0)

        lower = parse_ver('19.0.0.7')
        upper = parse_ver('26.0.0.5')
        fixed = parse_ver('26.0.0.6')

        if cmp_ver(pv, fixed) >= 0:
            print('PATCHED')
            sys.exit(0)
        if cmp_ver(pv, lower) >= 0 and cmp_ver(pv, upper) <= 0:
            print('VULNERABLE')
            sys.exit(1)
        print('PATCHED')
        sys.exit(0)

    version = get_traditional_version(root)
    if not version:
        print('UNKNOWN')
        sys.exit(2)
    pv = parse_ver(version)
    if not pv:
        print('UNKNOWN')
        sys.exit(2)

    if len(pv) >= 2 and pv[0] == 9:
        if cmp_ver(pv, parse_ver('9.0.5.28')) >= 0:
            print('PATCHED')
            sys.exit(0)
        if cmp_ver(pv, parse_ver('9.0.0.0')) >= 0 and cmp_ver(pv, parse_ver('9.0.5.27')) <= 0:
            print('VULNERABLE')
            sys.exit(1)
        print('UNKNOWN')
        sys.exit(2)

    if len(pv) >= 2 and pv[0] == 8 and pv[1] == 5:
        if cmp_ver(pv, parse_ver('8.5.5.30')) >= 0:
            print('PATCHED')
            sys.exit(0)
        if cmp_ver(pv, parse_ver('8.5.0.0')) >= 0 and cmp_ver(pv, parse_ver('8.5.5.29')) <= 0:
            print('VULNERABLE')
            sys.exit(1)
        print('UNKNOWN')
        sys.exit(2)

    print('UNKNOWN')
    sys.exit(2)


if __name__ == '__main__':
    main()