Oracle WebLogic Unsupported Version Detection

#requires -Version 5
<#
.SYNOPSIS
  Detects Oracle WebLogic versions that are out of vendor support.
.PARAMETER DomainHome
  Path to a WebLogic domain. If omitted, attempts auto-discovery under C:\Oracle.
.OUTPUTS
  VULNERABLE | PATCHED | UNKNOWN
#>
param(
  [string]$DomainHome = ''
)

$ErrorActionPreference = 'Stop'

# Released-and-supported family floor as of 2026-06-25.
# Anything < 14.1.2.0 is either EOL or rapidly approaching it.
$supportedFloor = [Version]'14.1.2.0'

function Get-WeblogicVersion {
  param([string]$home)
  $candidates = @(
    Join-Path $home 'registry.xml',
    (Join-Path $home '..\..\..\..\inventory\registry.xml'),
    (Join-Path $home '..\..\..\..\OPatch\config\inventory.xml')
  )
  foreach ($f in $candidates) {
    if (Test-Path $f) {
      $txt = Get-Content -Raw $f
      if ($txt -match 'WebLogic Server.*?(\d+\.\d+\.\d+(?:\.\d+)?)') {
        return $Matches[1]
      }
    }
  }
  # Fallback: run weblogic.version via java
  $wljar = Get-ChildItem -Path 'C:\Oracle' -Recurse -Filter 'weblogic.jar' -ErrorAction SilentlyContinue | Select-Object -First 1
  if ($wljar) {
    try {
      $out = & java -cp $wljar.FullName weblogic.version 2>&1
      if ($out -match 'WebLogic Server\s+(\d+\.\d+\.\d+(?:\.\d+)?)') { return $Matches[1] }
    } catch {}
  }
  return $null
}

if (-not $DomainHome) {
  $found = Get-ChildItem 'C:\Oracle' -Recurse -Directory -Filter 'domains' -ErrorAction SilentlyContinue | Select-Object -First 1
  if ($found) { $DomainHome = (Get-ChildItem $found.FullName -Directory | Select-Object -First 1).FullName }
}

if (-not $DomainHome -or -not (Test-Path $DomainHome)) {
  Write-Output 'UNKNOWN: no WebLogic domain located'
  exit 2
}

$ver = Get-WeblogicVersion -home $DomainHome
if (-not $ver) {
  Write-Output 'UNKNOWN: could not determine WebLogic version'
  exit 2
}

try { $v = [Version]$ver } catch { Write-Output "UNKNOWN: unparseable version $ver"; exit 2 }

if ($v -lt $supportedFloor) {
  Write-Output "VULNERABLE: WebLogic $ver is past Oracle support (floor $supportedFloor)"
  exit 1
} else {
  Write-Output "PATCHED: WebLogic $ver is in supported family"
  exit 0
}