JQuery 1.x < 1.12.0 / 2.x < 2.2.0 XSS

#!/usr/bin/env python3
# verify_jquery_106657.py
# Purpose: validate whether local jQuery assets match Tenable plugin 106657 conditions.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN/usage error

import os
import re
import sys
from typing import Optional, Tuple

VERSION_RE = re.compile(r"jQuery v?(\d+)\.(\d+)\.(\d+)", re.I)
FILENAME_RE = re.compile(r"jquery(?:[-.]min)?[-.]?(\d+)\.(\d+)\.(\d+)", re.I)
JS_EXT = (".js", ".jsp", ".html", ".htm", ".cshtml", ".php", ".twig")


def parse_version(text: str) -> Optional[Tuple[int, int, int]]:
    m = VERSION_RE.search(text)
    if m:
        return tuple(map(int, m.groups()))
    m = FILENAME_RE.search(text)
    if m:
        return tuple(map(int, m.groups()))
    return None


def classify(ver: Tuple[int, int, int]) -> str:
    major, minor, patch = ver
    # Tenable plugin 106657 logic
    if major == 1 and ver < (1, 12, 0):
        return "VULNERABLE"
    if major == 2 and ver < (2, 2, 0):
        return "VULNERABLE"

    # Important nuance: broader CVE-2015-9251 language says < 3.0.0.
    # Versions 1.12.x and 2.2.x contain the mitigation Tenable is looking for,
    # but may still be treated as affected by broader CVE records.
    if major in (1, 2) and ver >= ((1, 12, 0) if major == 1 else (2, 2, 0)):
        return "UNKNOWN"

    if major >= 3:
        return "PATCHED"

    return "UNKNOWN"


def inspect_file(path: str) -> Optional[Tuple[Tuple[int, int, int], str]]:
    # First try filename
    ver = parse_version(os.path.basename(path))
    if ver:
        return ver, classify(ver)

    # Then read a small chunk from the file body for the jQuery banner
    try:
        with open(path, "r", encoding="utf-8", errors="ignore") as f:
            chunk = f.read(65536)
        ver = parse_version(chunk)
        if ver:
            return ver, classify(ver)
    except Exception:
        return None
    return None


def main() -> int:
    if len(sys.argv) != 2:
        print("UNKNOWN - usage: python3 verify_jquery_106657.py <webroot-or-artifact-dir>")
        return 2

    root = sys.argv[1]
    if not os.path.exists(root):
        print(f"UNKNOWN - path does not exist: {root}")
        return 2

    findings = []
    for base, _, files in os.walk(root):
        for name in files:
            if not name.lower().endswith(JS_EXT):
                continue
            path = os.path.join(base, name)
            result = inspect_file(path)
            if result:
                ver, state = result
                findings.append((path, ver, state))

    if not findings:
        print("UNKNOWN - no identifiable jQuery assets found")
        return 2

    vulnerable = [f for f in findings if f[2] == "VULNERABLE"]
    unknown = [f for f in findings if f[2] == "UNKNOWN"]
    patched = [f for f in findings if f[2] == "PATCHED"]

    if vulnerable:
        path, ver, _ = vulnerable[0]
        print(f"VULNERABLE - found jQuery {ver[0]}.{ver[1]}.{ver[2]} at {path}")
        return 1

    if unknown:
        sample = unknown[0]
        path, ver, _ = sample
        print(f"UNKNOWN - found jQuery {ver[0]}.{ver[1]}.{ver[2]} at {path}; Tenable plugin condition may be mitigated, but broader CVE-2015-9251 scope should be reviewed")
        return 2

    path, ver, _ = patched[0]
    print(f"PATCHED - found jQuery {ver[0]}.{ver[1]}.{ver[2]} at {path}")
    return 0


if __name__ == "__main__":
    sys.exit(main())