Oracle WebLogic Server (Oct 2022 CPU)

#!/usr/bin/env bash
# noisgate verification — Oracle WebLogic Oct 2022 CPU (Tenable 166313)
# Exit 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -u
MW_HOME="${1:-}"
if [[ -z "$MW_HOME" || ! -d "$MW_HOME" ]]; then
  echo "usage: $0 <MW_HOME>"; echo "UNKNOWN"; exit 2
fi

# 1. Identify base WLS version
REG="$MW_HOME/inventory/registry.xml"
if [[ ! -f "$REG" ]]; then
  # fallback: parse from product.properties
  PROP=$(find "$MW_HOME" -name product.properties -path '*wlserver*' 2>/dev/null | head -n1)
  [[ -z "$PROP" ]] && { echo "UNKNOWN: no registry.xml or product.properties"; exit 2; }
  WLS_VER=$(awk -F= '/^WLS_PRODUCT_VERSION/ {print $2}' "$PROP" | tr -d '\r')
else
  WLS_VER=$(grep -oE 'WebLogic Server" version="[0-9.]+' "$REG" | head -n1 | awk -F'"' '{print $4}')
fi
echo "WLS base version: ${WLS_VER:-unknown}"

if [[ -z "$WLS_VER" ]]; then echo "UNKNOWN"; exit 2; fi

# 2. Plugin scope: 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
case "$WLS_VER" in
  12.2.1.3.0|12.2.1.4.0|14.1.1.0.0) ;;
  *) echo "PATCHED (version $WLS_VER outside 166313 scope)"; exit 0 ;;
esac

# 3. Check for Oct 2022 PSU and later via OPatch
OPATCH="$MW_HOME/OPatch/opatch"
[[ ! -x "$OPATCH" ]] && OPATCH=$(find "$MW_HOME" -name opatch -type f 2>/dev/null | head -n1)
if [[ -z "$OPATCH" || ! -x "$OPATCH" ]]; then
  echo "UNKNOWN: opatch not found"; exit 2
fi

ORACLE_HOME="$MW_HOME" "$OPATCH" lsinventory -oh "$MW_HOME" 2>/dev/null > /tmp/wls_inv.$$
if ! [[ -s /tmp/wls_inv.$$ ]]; then
  echo "UNKNOWN: opatch lsinventory empty"; rm -f /tmp/wls_inv.$$; exit 2
fi

# Oct 2022 PSU patch IDs per Oracle Doc 2806740.2
# 12.2.1.3.0 -> 34604561 ; 12.2.1.4.0 -> 34601861 ; 14.1.1.0.0 -> 34601734
declare -A PSU=(
  [12.2.1.3.0]=34604561
  [12.2.1.4.0]=34601861
  [14.1.1.0.0]=34601734
)
REQ=${PSU[$WLS_VER]}
if grep -qE "Patch[[:space:]]+($REQ|[0-9]{8})" /tmp/wls_inv.$$ && grep -qE "WLS PATCH SET UPDATE (12|14)\.[0-9.]+" /tmp/wls_inv.$$; then
  # any installed PSU >= Oct 2022? look for date strings 2022-10 or later
  if grep -qE '2022-1[0-2]|202[3-9]-[0-9]{2}' /tmp/wls_inv.$$; then
    echo "PATCHED (PSU at or after Oct 2022 detected)"; rm -f /tmp/wls_inv.$$; exit 0
  fi
fi

echo "VULNERABLE: $WLS_VER without Oct 2022 PSU (expected patch $REQ or newer)"
rm -f /tmp/wls_inv.$$
exit 1