VMware vCenter Server 6.5 < 6.5 U3u / 6.7 < 6.7.0 U3s / 7.0 < 7.0 U3i Multiple Vulnerabilities (VMSA-2022-0030)

#!/usr/bin/env python3
# check_vcenter_vmsa_2022_0030.py
# Detects whether the local VMware vCenter host is vulnerable to VMSA-2022-0030
# (Tenable plugin 168746 / CVE-2022-31697 and CVE-2022-31698)
#
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import platform
import re
import subprocess
import sys

THRESHOLDS = {
    '6.5': 20510539,   # 6.5 U3u
    '6.7': 20504362,   # 6.7 U3s (VCSA vpxd build)
    '7.0': 20845200,   # 7.0 U3i
}


def run(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True, timeout=10)
        return p.stdout.strip()
    except Exception:
        return ''


def parse_version_build(text):
    # Accepts common outputs like:
    #   VMware VirtualCenter 7.0.3 build-20845200
    #   7.0.3.01100 build 20845200
    if not text:
        return None, None

    version = None
    build = None

    m = re.search(r'(\d+\.\d+\.\d+(?:\.\d+)?)', text)
    if m:
        version = m.group(1)

    m = re.search(r'build[-\s:]*(\d{5,})', text, re.IGNORECASE)
    if m:
        build = int(m.group(1))
    else:
        nums = re.findall(r'\b(\d{7,})\b', text)
        if nums:
            build = int(nums[-1])

    return version, build


def linux_collect():
    candidates = [
        ['/usr/sbin/vpxd', '-v'],
        ['/usr/lib/vmware-vpxd/vpxd', '-v'],
        ['vpxd', '-v'],
    ]

    for cmd in candidates:
        out = run(cmd)
        v, b = parse_version_build(out)
        if v and b:
            return v, b, 'command: ' + ' '.join(cmd)

    for path in ['/etc/vmware/.buildInfo', '/etc/applmgmt/appliance/update.conf']:
        if os.path.exists(path):
            try:
                data = open(path, 'r', encoding='utf-8', errors='ignore').read()
                v, b = parse_version_build(data)
                if v and b:
                    return v, b, 'file: ' + path
            except Exception:
                pass

    return None, None, ''


def windows_collect():
    try:
        import winreg
    except Exception:
        return None, None, ''

    reg_paths = [
        r'SOFTWARE\VMware, Inc.\VMware VirtualCenter',
        r'SOFTWARE\WOW6432Node\VMware, Inc.\VMware VirtualCenter',
    ]

    values = []
    for root in (0x80000002,):  # HKEY_LOCAL_MACHINE
        for reg_path in reg_paths:
            try:
                key = winreg.OpenKey(root, reg_path)
                i = 0
                while True:
                    try:
                        name, val, _ = winreg.EnumValue(key, i)
                        values.append(f'{name}={val}')
                        i += 1
                    except OSError:
                        break
            except OSError:
                continue

    joined = '\n'.join(values)
    v, b = parse_version_build(joined)
    if v and b:
        return v, b, 'registry'

    candidates = [
        r'C:\Program Files\VMware\Infrastructure\VirtualCenter Server\vpxd.exe',
        r'C:\Program Files\VMware\Infrastructure\vCenter Server\vpxd.exe',
    ]
    for path in candidates:
        if os.path.exists(path):
            out = run([path, '-v'])
            v, b = parse_version_build(out)
            if v and b:
                return v, b, 'binary: ' + path

    return None, None, ''


def branch(version_str):
    if version_str.startswith('6.5.'):
        return '6.5'
    if version_str.startswith('6.7.'):
        return '6.7'
    if version_str.startswith('7.0.'):
        return '7.0'
    return None


def main():
    system = platform.system().lower()
    version = build = source = None

    if 'windows' in system:
        version, build, source = windows_collect()
    else:
        version, build, source = linux_collect()

    if not version or not build:
        print('UNKNOWN - could not determine local vCenter version/build')
        sys.exit(2)

    rel = branch(version)
    if rel is None:
        print(f'UNKNOWN - detected version {version} build {build} from {source}, but it is outside 6.5/6.7/7.0 scope')
        sys.exit(2)

    threshold = THRESHOLDS[rel]
    if build < threshold:
        print(f'VULNERABLE - detected vCenter {version} build {build} from {source}; fixed threshold for {rel} is build {threshold}')
        sys.exit(1)
    else:
        print(f'PATCHED - detected vCenter {version} build {build} from {source}; meets or exceeds fixed threshold {threshold}')
        sys.exit(0)


if __name__ == '__main__':
    main()