IBM WebSphere Application Server - Liberty 22

#!/usr/bin/env python3
# CVE-2026-5516 Liberty check
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=USAGE/ERROR

import os
import re
import sys
import subprocess
import xml.etree.ElementTree as ET
from pathlib import Path

AFFECTED_FEATURES = {"appSecurity-3.0", "appSecurity-4.0", "appSecurity-5.0"}
FIX_APAR = "PH70798"


def parse_ver(v):
    try:
        return tuple(int(x) for x in v.strip().split('.'))
    except Exception:
        return None


def ver_in_range(v, low, high):
    return low <= v <= high


def run_cmd(cmd):
    try:
        cp = subprocess.run(cmd, capture_output=True, text=True, timeout=20)
        return cp.returncode, (cp.stdout or "") + (cp.stderr or "")
    except Exception as e:
        return 999, str(e)


def find_productinfo(liberty_root):
    root = Path(liberty_root)
    candidates = [
        root / "bin" / "productInfo",
        root / "bin" / "productInfo.bat",
        root / "wlp" / "bin" / "productInfo",
        root / "wlp" / "bin" / "productInfo.bat",
    ]
    for c in candidates:
        if c.exists():
            return c
    return None


def get_version_and_ifixes(productinfo):
    rc1, out1 = run_cmd([str(productinfo), "version"])
    rc2, out2 = run_cmd([str(productinfo), "version", "--ifixes"])
    text = out1 + "\n" + out2
    m = re.search(r"Product version:\s*([0-9]+(?:\.[0-9]+){1,3})", text)
    version = m.group(1) if m else None
    return version, text


def feature_hits_from_xml(server_xml):
    hits = set()
    try:
        tree = ET.parse(server_xml)
        root = tree.getroot()
        for elem in root.iter():
            tag = elem.tag.split('}')[-1]
            if tag == "feature" and elem.text:
                val = elem.text.strip()
                if val in AFFECTED_FEATURES:
                    hits.add(val)
    except Exception:
        pass
    return hits


def feature_hits_from_logs(server_dir):
    hits = set()
    log_candidates = [
        Path(server_dir) / "logs" / "messages.log",
        Path(server_dir) / "logs" / "console.log",
        Path(server_dir) / "logs" / "trace.log",
    ]
    for lp in log_candidates:
        if not lp.exists():
            continue
        try:
            with lp.open("r", encoding="utf-8", errors="ignore") as fh:
                for line in fh:
                    if "CWWKF0012I" in line or any(f in line for f in AFFECTED_FEATURES):
                        for feat in AFFECTED_FEATURES:
                            if feat in line:
                                hits.add(feat)
        except Exception:
            pass
    return hits


def main():
    if len(sys.argv) < 2:
        print("UNKNOWN - usage: liberty_cve_2026_5516_check.py <liberty_root> [server_dir]")
        sys.exit(3)

    liberty_root = sys.argv[1]
    server_dir = sys.argv[2] if len(sys.argv) > 2 else None

    productinfo = find_productinfo(liberty_root)
    if not productinfo:
        print("UNKNOWN - could not locate Liberty productInfo command")
        sys.exit(2)

    version_str, ifix_text = get_version_and_ifixes(productinfo)
    if not version_str:
        print("UNKNOWN - could not determine Liberty version from productInfo")
        sys.exit(2)

    version = parse_ver(version_str)
    if not version:
        print(f"UNKNOWN - unparseable Liberty version: {version_str}")
        sys.exit(2)

    if FIX_APAR in ifix_text or version >= parse_ver("26.0.0.6"):
        print(f"PATCHED - Liberty {version_str} with {FIX_APAR} present or version >= 26.0.0.6")
        sys.exit(0)

    low = parse_ver("22.0.0.11")
    high = parse_ver("26.0.0.5")

    if not ver_in_range(version, low, high):
        if version > high:
            print(f"PATCHED - Liberty {version_str} is newer than affected range")
            sys.exit(0)
        print(f"UNKNOWN - Liberty {version_str} is outside IBM's published affected range; verify support status manually")
        sys.exit(2)

    # Affected version band: need runtime feature confirmation.
    features = set()
    if server_dir:
        server_xml = Path(server_dir) / "server.xml"
        if server_xml.exists():
            features |= feature_hits_from_xml(server_xml)
        features |= feature_hits_from_logs(server_dir)

    if features:
        feats = ", ".join(sorted(features))
        print(f"VULNERABLE - Liberty {version_str} in affected range and runtime/config indicates: {feats}")
        sys.exit(1)

    print(f"UNKNOWN - Liberty {version_str} is in affected range, but affected appSecurity feature use was not confirmed. Check CWWKF0012I in server logs and confirm whether {FIX_APAR} interim fix is installed.")
    sys.exit(2)


if __name__ == "__main__":
    main()