nginx 1

#!/usr/bin/env bash
# check_nginx_118956.sh
# Assess exposure for Tenable plugin 118956 / nginx CVE-2018-16843, -16844, -16845
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

have_cmd() { command -v "$1" >/dev/null 2>&1; }

semver_ge() {
  [ "$1" = "$2" ] && return 0
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

semver_lt() {
  [ "$1" = "$2" ] && return 1
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]
}

pkg_version_ge() {
  # Compare distro package versions if dpkg or rpm is available
  local a="$1" b="$2"
  if have_cmd dpkg --compare-versions 1 1 >/dev/null 2>&1; then
    dpkg --compare-versions "$a" ge "$b"
    return $?
  fi
  if have_cmd rpm; then
    rpm --quiet --eval '%{?dist}' >/dev/null 2>&1
    [ "$(printf '%s\n%s\n' "$a" "$b" | sort -V | tail -n1)" = "$a" ]
    return $?
  fi
  return 1
}

status="UNKNOWN"
reasons=()

if ! have_cmd nginx; then
  echo "UNKNOWN: nginx binary not found in PATH"
  exit 2
fi

nginx_v_raw="$(nginx -V 2>&1)"
nginx_t_raw="$(nginx -T 2>&1)"

nginx_ver="$(printf '%s' "$nginx_v_raw" | sed -n 's/^nginx version: nginx\/\([0-9][0-9.]*\).*$/\1/p' | head -n1)"
if [ -z "$nginx_ver" ]; then
  echo "UNKNOWN: unable to parse nginx version from 'nginx -V'"
  exit 2
fi

http2_compiled=0
mp4_compiled=0
printf '%s' "$nginx_v_raw" | grep -Eq 'http_v2_module' && http2_compiled=1
printf '%s' "$nginx_v_raw" | grep -Eq 'http_mp4_module' && mp4_compiled=1

http2_enabled=0
mp4_enabled=0
printf '%s\n' "$nginx_t_raw" | grep -Eiq '^[[:space:]]*listen[[:space:]].*http2([;[:space:]]|$)|^[[:space:]]*http2[[:space:]]+on[[:space:]]*;' && http2_enabled=1
printf '%s\n' "$nginx_t_raw" | grep -Eiq '^[[:space:]]*mp4[[:space:]]*;' && mp4_enabled=1

# Distro package version checks for common backports
pkg_name=""
pkg_ver=""
if have_cmd dpkg-query; then
  for p in nginx nginx-core nginx-full nginx-light nginx-extras nginx-common; do
    if dpkg-query -W -f='${Status} ${Version}\n' "$p" 2>/dev/null | grep -q '^install ok installed '; then
      pkg_name="$p"
      pkg_ver="$(dpkg-query -W -f='${Version}' "$p" 2>/dev/null)"
      break
    fi
  done
elif have_cmd rpm; then
  if rpm -q nginx >/dev/null 2>&1; then
    pkg_name="nginx"
    pkg_ver="$(rpm -q --qf '%{VERSION}-%{RELEASE}' nginx 2>/dev/null)"
  fi
fi

backport_patched=0
if [ -n "$pkg_ver" ]; then
  case "$pkg_ver" in
    *1.10.3-1+deb9u2*|*1.10.3-1+deb9u3*|*1.10.3-0ubuntu0.16.04.3*|*1.14.0-0ubuntu1.2*|*1.15.5-0ubuntu2.1*|*1.4.6-1ubuntu3.9*)
      backport_patched=1
      ;;
  esac
fi

http2_range_vuln=0
mp4_range_vuln=0

# HTTP/2 affected: 1.9.5-1.15.5; fixed in 1.14.1 and 1.15.6
if semver_ge "$nginx_ver" "1.9.5"; then
  if semver_lt "$nginx_ver" "1.14.1"; then
    http2_range_vuln=1
  elif semver_ge "$nginx_ver" "1.15.0" && semver_lt "$nginx_ver" "1.15.6"; then
    http2_range_vuln=1
  fi
fi

# MP4 affected: 1.1.3-1.15.5 and 1.0.7-1.0.15; fixed in 1.14.1 and 1.15.6
if semver_ge "$nginx_ver" "1.1.3"; then
  if semver_lt "$nginx_ver" "1.14.1"; then
    mp4_range_vuln=1
  elif semver_ge "$nginx_ver" "1.15.0" && semver_lt "$nginx_ver" "1.15.6"; then
    mp4_range_vuln=1
  fi
elif semver_ge "$nginx_ver" "1.0.7" && semver_lt "$nginx_ver" "1.0.16"; then
  mp4_range_vuln=1
fi

if [ "$backport_patched" -eq 1 ]; then
  echo "PATCHED: distro package backport detected (${pkg_name} ${pkg_ver})"
  exit 0
fi

http2_reachable=0
mp4_reachable=0
[ "$http2_range_vuln" -eq 1 ] && [ "$http2_compiled" -eq 1 ] && [ "$http2_enabled" -eq 1 ] && http2_reachable=1
[ "$mp4_range_vuln" -eq 1 ] && [ "$mp4_compiled" -eq 1 ] && [ "$mp4_enabled" -eq 1 ] && mp4_reachable=1

if [ "$http2_reachable" -eq 1 ] || [ "$mp4_reachable" -eq 1 ]; then
  echo "VULNERABLE: nginx ${nginx_ver} with reachable vulnerable path(s): HTTP2=${http2_reachable} MP4=${mp4_reachable}"
  echo "DETAIL: compiled_http2=${http2_compiled} enabled_http2=${http2_enabled} compiled_mp4=${mp4_compiled} enabled_mp4=${mp4_enabled}"
  exit 1
fi

# Not in vulnerable range, or features not reachable
if [ "$http2_range_vuln" -eq 0 ] && [ "$mp4_range_vuln" -eq 0 ]; then
  echo "PATCHED: nginx ${nginx_ver} is outside the upstream vulnerable ranges"
  exit 0
fi

if [ "$http2_range_vuln" -eq 1 ] || [ "$mp4_range_vuln" -eq 1 ]; then
  echo "PATCHED: nginx ${nginx_ver} is in a nominal vulnerable version range, but no reachable vulnerable config was found (HTTP2 compiled=${http2_compiled}, enabled=${http2_enabled}; MP4 compiled=${mp4_compiled}, enabled=${mp4_enabled})"
  exit 0
fi

echo "UNKNOWN: insufficient data to determine exposure"
exit 2