IBM WebSphere Application Server 9

#!/usr/bin/env python3
# check_cve_2026_8644.py
# Detect likely exposure to CVE-2026-8644 on IBM WebSphere Application Server traditional.
# Logic:
#   - Find versionInfo.sh / versionInfo.bat in common install paths or via WAS_HOME.
#   - Execute it and parse the reported version / fix pack / maintenance level.
#   - If APAR PH71422 is present => PATCHED.
#   - Else compare version against fixed baselines:
#       8.5.x < 8.5.5.30 => VULNERABLE
#       9.0.x < 9.0.5.29 => VULNERABLE
#       >= fixed baselines => PATCHED
#   - Anything else => UNKNOWN
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN

import os
import re
import sys
import subprocess
from pathlib import Path

FIXED_85 = (8, 5, 5, 30)
FIXED_90 = (9, 0, 5, 29)
APAR = 'PH71422'


def norm_version_tuple(v):
    nums = [int(x) for x in re.findall(r'\d+', v)]
    while len(nums) < 4:
        nums.append(0)
    return tuple(nums[:4])


def cmp_tuple(a, b):
    return (a > b) - (a < b)


def candidate_paths():
    cands = []
    envs = [os.environ.get('WAS_HOME'), os.environ.get('WAS_INSTALL_ROOT')]
    for e in envs:
        if e:
            root = Path(e)
            cands.extend([
                root / 'bin' / 'versionInfo.sh',
                root / 'bin' / 'versionInfo.bat',
                root / 'versionInfo.sh',
                root / 'versionInfo.bat',
            ])

    common_roots = [
        '/opt/IBM/WebSphere/AppServer',
        '/usr/IBM/WebSphere/AppServer',
        '/QIBM/ProdData/WebSphere/AppServer',
        'C:\\Program Files\\IBM\\WebSphere\\AppServer',
        'C:\\IBM\\WebSphere\\AppServer',
    ]
    for r in common_roots:
        root = Path(r)
        cands.extend([
            root / 'bin' / 'versionInfo.sh',
            root / 'bin' / 'versionInfo.bat',
        ])
    return cands


def find_versioninfo():
    for p in candidate_paths():
        if p.exists():
            return p
    return None


def run_versioninfo(path):
    try:
        if str(path).lower().endswith('.bat'):
            cmd = ['cmd.exe', '/c', str(path)]
        else:
            cmd = ['/bin/sh', str(path)]
        proc = subprocess.run(cmd, capture_output=True, text=True, timeout=90)
        return (proc.stdout or '') + '\n' + (proc.stderr or '')
    except Exception as e:
        return f'ERROR: {e}'


def parse_version(text):
    patterns = [
        r'Version\s*[:=]\s*([0-9]+(?:\.[0-9]+){1,3})',
        r'Installed\s+Product\s+Version\s*[:=]\s*([0-9]+(?:\.[0-9]+){1,3})',
        r'([89]\.0\.5\.\d+)',
        r'(8\.5\.5\.\d+)',
    ]
    for pat in patterns:
        m = re.search(pat, text, re.IGNORECASE)
        if m:
            return m.group(1)
    return None


def parse_ifixes(text):
    hits = set(re.findall(r'PH\d{5}', text, re.IGNORECASE))
    return {h.upper() for h in hits}


def assess(version_str, ifixes):
    if APAR in ifixes:
        return 'PATCHED', f'Interim fix {APAR} detected'

    if not version_str:
        return 'UNKNOWN', 'Could not parse WebSphere version'

    vt = norm_version_tuple(version_str)

    if vt[0] == 8 and vt[1] == 5:
        if cmp_tuple(vt, FIXED_85) < 0:
            return 'VULNERABLE', f'8.5 baseline {version_str} is below 8.5.5.30 and no {APAR} fix detected'
        return 'PATCHED', f'8.5 baseline {version_str} is at or above 8.5.5.30'

    if vt[0] == 9 and vt[1] == 0:
        if cmp_tuple(vt, FIXED_90) < 0:
            return 'VULNERABLE', f'9.0 baseline {version_str} is below 9.0.5.29 and no {APAR} fix detected'
        return 'PATCHED', f'9.0 baseline {version_str} is at or above 9.0.5.29'

    return 'UNKNOWN', f'Parsed version {version_str}, but it is outside the bulletin scope for this check'


def main():
    vi = find_versioninfo()
    if not vi:
        print('UNKNOWN - versionInfo script not found. Set WAS_HOME or run on the WebSphere host.')
        sys.exit(2)

    output = run_versioninfo(vi)
    if output.startswith('ERROR:'):
        print(f'UNKNOWN - failed to execute {vi}: {output}')
        sys.exit(2)

    version_str = parse_version(output)
    ifixes = parse_ifixes(output)
    state, reason = assess(version_str, ifixes)

    print(f'{state} - {reason}')
    print(f'INFO - versionInfo path: {vi}')
    print(f'INFO - parsed version: {version_str or "none"}')
    print(f'INFO - detected APARs: {", ".join(sorted(ifixes)) if ifixes else "none"}')

    if state == 'PATCHED':
        sys.exit(0)
    elif state == 'VULNERABLE':
        sys.exit(1)
    else:
        sys.exit(2)


if __name__ == '__main__':
    main()