Apache mod_suexec Multiple Privilege Escalation Vulnerabilities

#!/usr/bin/env bash
# verify_suexec_17693.sh
# Assess practical exposure to Nessus plugin 17693 (Apache mod_suexec privilege escalation issues)
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

CONFIG_HINTS=("$@")
COMMON_CONFIGS=(/etc/httpd /etc/apache2 /usr/local/apache2/conf)

say() { printf '%s\n' "$1"; }

find_bin() {
  local names=(apachectl apache2ctl httpd)
  local n p
  for n in "${names[@]}"; do
    p=$(command -v "$n" 2>/dev/null || true)
    if [ -n "$p" ]; then
      echo "$p"
      return 0
    fi
  done
  return 1
}

ver_ge() {
  # returns 0 if $1 >= $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

ver_lt() {
  # returns 0 if $1 < $2
  ! ver_ge "$1" "$2"
}

find_httpd_version() {
  local ctl="$1" out ver
  out=$($ctl -v 2>/dev/null || true)
  ver=$(printf '%s' "$out" | sed -n 's/.*Apache\/\([0-9][0-9.]*\).*/\1/p' | head -n1)
  printf '%s' "$ver"
}

find_suexec_bin() {
  local ctl="$1" out bin
  out=$($ctl -V 2>/dev/null || true)
  bin=$(printf '%s\n' "$out" | sed -n 's/.*-D SUEXEC_BIN="\([^"]*\)".*/\1/p' | head -n1)
  if [ -n "$bin" ] && [ -e "$bin" ]; then
    printf '%s' "$bin"
    return 0
  fi
  for bin in /usr/sbin/suexec /usr/lib/apache2/suexec /usr/local/apache2/bin/suexec /usr/local/apache2/sbin/suexec; do
    if [ -e "$bin" ]; then
      printf '%s' "$bin"
      return 0
    fi
  done
  return 1
}

collect_configs() {
  local paths=()
  local d
  for d in "${CONFIG_HINTS[@]}"; do
    [ -e "$d" ] && paths+=("$d")
  done
  for d in "${COMMON_CONFIGS[@]}"; do
    [ -e "$d" ] && paths+=("$d")
  done
  printf '%s\n' "${paths[@]}" | awk 'NF && !seen[$0]++'
}

main() {
  local ctl version suexec suexec_mode cfgpaths apache_user suexec_enabled=0 risky_cfg=0 writable_docroot=0 userdir_seen=0
  local paths_text modules_text roots f owner group mode

  ctl=$(find_bin || true)
  if [ -z "$ctl" ]; then
    say "UNKNOWN"
    exit 2
  fi

  version=$(find_httpd_version "$ctl")
  if [ -z "$version" ]; then
    say "UNKNOWN"
    exit 2
  fi

  suexec=$(find_suexec_bin "$ctl" || true)
  if [ -z "$suexec" ]; then
    # No suexec wrapper => this advisory path is not applicable in practice
    say "PATCHED"
    exit 0
  fi

  if [ ! -u "$suexec" ]; then
    # Not setuid root => wrapper is not practically exposed as designed
    say "PATCHED"
    exit 0
  fi

  modules_text=$($ctl -M 2>/dev/null || true)
  cfgpaths=$(collect_configs)
  paths_text=$(printf '%s\n' "$cfgpaths")

  # Determine Apache runtime user
  apache_user=$(printf '%s\n' "$paths_text" | xargs -r grep -RhsE '^[[:space:]]*User[[:space:]]+' 2>/dev/null | awk '{print $2}' | tail -n1)
  [ -z "$apache_user" ] && apache_user=www-data

  # Any sign suexec might actually be used?
  if printf '%s\n' "$modules_text" | grep -qi 'suexec_module'; then
    suexec_enabled=1
  fi
  if printf '%s\n' "$paths_text" | xargs -r grep -RhsE '^[[:space:]]*SuexecUserGroup[[:space:]]+' 2>/dev/null | grep -q .; then
    suexec_enabled=1
    risky_cfg=1
  fi
  if printf '%s\n' "$paths_text" | xargs -r grep -RhsE '^[[:space:]]*UserDir[[:space:]]+' 2>/dev/null | grep -q .; then
    userdir_seen=1
    suexec_enabled=1
    risky_cfg=1
  fi

  # Gather document roots and test writability/ownership smell
  roots=$(printf '%s\n' "$paths_text" | xargs -r grep -RhsE '^[[:space:]]*DocumentRoot[[:space:]]+' 2>/dev/null | sed -E 's/^[[:space:]]*DocumentRoot[[:space:]]+"?([^" ]+)"?.*/\1/' | sort -u)

  if [ -n "$roots" ]; then
    while IFS= read -r f; do
      [ -z "$f" ] && continue
      [ ! -e "$f" ] && continue
      owner=$(stat -c '%U' "$f" 2>/dev/null || echo unknown)
      group=$(stat -c '%G' "$f" 2>/dev/null || echo unknown)
      mode=$(stat -c '%a' "$f" 2>/dev/null || echo 000)

      # Writable by apache user, world-writable, or group-writable and apache group owns it
      if sudo -n -u "$apache_user" test -w "$f" 2>/dev/null; then
        writable_docroot=1
      fi
      case "$mode" in
        ???2|???3|???6|???7|??2?|??3?|??6?|??7?) writable_docroot=1 ;;
      esac
      if [ "$owner" = "$apache_user" ]; then
        writable_docroot=1
      fi
    done <<< "$roots"
  fi

  # Decision logic
  # Strongly patched/not applicable cases first
  if ver_ge "$version" "2.4.0"; then
    say "PATCHED"
    exit 0
  fi

  if ver_ge "$version" "2.2.6"; then
    say "PATCHED"
    exit 0
  fi

  # Practical vulnerable cases: old version + live suexec + risky config/permissions
  if ver_lt "$version" "2.2.6" && [ "$suexec_enabled" -eq 1 ] && { [ "$risky_cfg" -eq 1 ] || [ "$writable_docroot" -eq 1 ] || [ "$userdir_seen" -eq 1 ]; }; then
    say "VULNERABLE"
    exit 1
  fi

  # Old version and suexec present, but no proof of actual exposure
  say "UNKNOWN"
  exit 2
}

main