Apache 2.4.x < 2.4.56 Multiple Vulnerabilities

#!/usr/bin/env bash
# check_apache_2456_smuggling.sh
# Purpose: Assess likely exposure to Apache httpd < 2.4.56 issues covered by Tenable plugin 172186
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN

set -u

APACHECTL=""
for c in apachectl apache2ctl httpd; do
  if command -v "$c" >/dev/null 2>&1; then
    APACHECTL="$(command -v "$c")"
    break
  fi
done

if [ -z "$APACHECTL" ]; then
  echo "UNKNOWN: apachectl/apache2ctl/httpd not found"
  exit 2
fi

VER_OUT="$($APACHECTL -v 2>/dev/null | head -n 1)"
VER="$(echo "$VER_OUT" | sed -n 's/.*Apache\/\([0-9][0-9.]*\).*/\1/p')"
if [ -z "$VER" ]; then
  echo "UNKNOWN: could not determine Apache version"
  exit 2
fi

ver_lt() {
  # returns 0 if $1 < $2
  [ "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ] && return 1
  [ "$1" = "$2" ] && return 1
  return 0
}

if ! ver_lt "$VER" "2.4.56"; then
  echo "PATCHED: Apache version $VER is >= 2.4.56"
  exit 0
fi

MODS="$($APACHECTL -M 2>/dev/null || true)"
HAS_PROXY=0
HAS_REWRITE=0
HAS_UWSGI=0

echo "$MODS" | grep -Eq 'proxy_module|proxy_http_module|proxy_fcgi_module|proxy_ajp_module|proxy_wstunnel_module' && HAS_PROXY=1
echo "$MODS" | grep -Eq 'rewrite_module' && HAS_REWRITE=1
echo "$MODS" | grep -Eq 'proxy_uwsgi_module' && HAS_UWSGI=1

CONF_ROOTS="/etc/httpd /etc/apache2 /usr/local/apache2/conf"
CONF_FILES=""
for d in $CONF_ROOTS; do
  if [ -d "$d" ]; then
    CONF_FILES="$CONF_FILES $(find "$d" -type f \( -name '*.conf' -o -name 'httpd.conf' -o -name 'apache2.conf' \) 2>/dev/null)"
  fi
done

if [ -z "$CONF_FILES" ]; then
  if [ "$HAS_UWSGI" -eq 1 ]; then
    echo "VULNERABLE: Apache $VER < 2.4.56 and mod_proxy_uwsgi is loaded (config files not fully inspected)"
    exit 1
  fi
  echo "UNKNOWN: Apache $VER < 2.4.56 but no readable config files found"
  exit 2
fi

# Heuristic checks for risky config patterns tied to CVE-2023-25690
RISK_REWRITE=0
RISK_PROXYPASSMATCH=0

# RewriteRule with [P] and a backreference ($1 etc.)
if grep -RIEq '^[[:space:]]*RewriteRule[[:space:]].*\$[0-9].*\[[^]]*P[^]]*\]' $CONF_FILES 2>/dev/null; then
  RISK_REWRITE=1
fi

# ProxyPassMatch with backreference in target
if grep -RIEq '^[[:space:]]*ProxyPassMatch[[:space:]].*\$[0-9]' $CONF_FILES 2>/dev/null; then
  RISK_PROXYPASSMATCH=1
fi

if [ "$HAS_UWSGI" -eq 1 ]; then
  echo "VULNERABLE: Apache $VER < 2.4.56 and mod_proxy_uwsgi is loaded (CVE-2023-27522 path present)"
  exit 1
fi

if [ "$HAS_PROXY" -eq 1 ] && [ "$HAS_REWRITE" -eq 1 ] && { [ "$RISK_REWRITE" -eq 1 ] || [ "$RISK_PROXYPASSMATCH" -eq 1 ]; }; then
  echo "VULNERABLE: Apache $VER < 2.4.56 with proxy+rewrite and likely unsafe RewriteRule/ProxyPassMatch pattern"
  exit 1
fi

if [ "$HAS_PROXY" -eq 1 ] || [ "$HAS_REWRITE" -eq 1 ]; then
  echo "UNKNOWN: Apache $VER < 2.4.56, but no obvious exploitable proxy rewrite pattern found by heuristic scan"
  exit 2
fi

echo "UNKNOWN: Apache $VER < 2.4.56, but affected modules/patterns were not confirmed"
exit 2