Apache ServerTokens Information Disclosure

#!/usr/bin/env bash
# check_servertokens.sh
# Purpose: determine whether Apache is vulnerable to verbose ServerTokens disclosure.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

status="UNKNOWN"
reason=""

have_cmd() { command -v "$1" >/dev/null 2>&1; }

trim() {
  sed -E 's/^[[:space:]]+//; s/[[:space:]]+$//'
}

probe_header() {
  local url="$1"
  if ! have_cmd curl; then
    return 1
  fi
  curl -ksSI --max-time 5 "$url" 2>/dev/null | awk 'BEGIN{IGNORECASE=1} /^Server:/ {sub(/\r$/, ""); print; exit}'
}

header_is_verbose() {
  local line="$1"
  local value
  value="${line#Server: }"
  # Vulnerable if Apache discloses version, OS, or module detail.
  # Safe if exactly 'Apache' (case-insensitive) or no Apache header at all.
  if [[ -z "$value" ]]; then
    return 1
  fi
  shopt -s nocasematch
  if [[ "$value" =~ ^Apache$ ]]; then
    shopt -u nocasematch
    return 1
  fi
  if [[ "$value" =~ ^Apache(/|[[:space:]]+\(|[[:space:]]+[A-Za-z0-9_-]) ]]; then
    shopt -u nocasematch
    return 0
  fi
  shopt -u nocasematch
  return 1
}

collect_configs() {
  local files=()
  local roots=(
    /etc/httpd/conf/httpd.conf
    /etc/httpd/conf.modules.d/*.conf
    /etc/httpd/conf.d/*.conf
    /etc/apache2/apache2.conf
    /etc/apache2/httpd.conf
    /etc/apache2/conf-enabled/*.conf
    /etc/apache2/conf.d/*.conf
    /usr/local/apache2/conf/httpd.conf
  )

  local p
  for p in "${roots[@]}"; do
    for f in $p; do
      [[ -r "$f" ]] && files+=("$f")
    done
  done

  printf '%s\n' "${files[@]}" | awk 'NF && !seen[$0]++'
}

config_servertokens_state() {
  local files
  files=$(collect_configs)
  [[ -z "$files" ]] && return 1

  awk '
    BEGIN { IGNORECASE=1 }
    /^[[:space:]]*#/ { next }
    {
      line=$0
      sub(/[[:space:]]*#.*/, "", line)
      if (match(line, /^[[:space:]]*ServerTokens[[:space:]]+([^[:space:]]+)/, m)) {
        last=m[1]
      }
    }
    END {
      if (last != "") print last
    }
  ' $files 2>/dev/null | tail -n 1
}

http_header=$(probe_header "http://127.0.0.1/")
https_header=$(probe_header "https://127.0.0.1/")
config_state=$(config_servertokens_state | trim)

if [[ -n "$http_header" ]] && header_is_verbose "$http_header"; then
  echo "VULNERABLE"
  echo "Reason: verbose live HTTP header: $http_header"
  exit 1
fi

if [[ -n "$https_header" ]] && header_is_verbose "$https_header"; then
  echo "VULNERABLE"
  echo "Reason: verbose live HTTPS header: $https_header"
  exit 1
fi

shopt -s nocasematch
if [[ -n "$config_state" ]]; then
  if [[ "$config_state" =~ ^Prod(uctOnly)?$ ]]; then
    if [[ -n "$http_header" || -n "$https_header" ]]; then
      echo "PATCHED"
      echo "Reason: live localhost header is not verbose and config sets ServerTokens $config_state"
      exit 0
    else
      echo "PATCHED"
      echo "Reason: config sets ServerTokens $config_state (no live localhost header observed)"
      exit 0
    fi
  elif [[ "$config_state" =~ ^(Full|OS|Minor|Major|Min|Minimal)$ ]]; then
    echo "VULNERABLE"
    echo "Reason: Apache config sets ServerTokens $config_state"
    exit 1
  fi
fi
shopt -u nocasematch

if [[ -n "$http_header" || -n "$https_header" ]]; then
  echo "PATCHED"
  echo "Reason: live localhost header is not verbose"
  exit 0
fi

echo "UNKNOWN"
echo "Reason: could not read an Apache config decision or observe a localhost Apache header"
exit 2