Apache on Windows mod_alias URL Validation Canonicalization CG

# check-cve-2006-4110.ps1

# Detect likely exposure to CVE-2006-4110 on Apache/Windows.

# Logic:

#  - confirm Windows host

#  - parse Apache version from httpd.exe if available

#  - read httpd.conf and simple Include files if they exist beside it

#  - extract DocumentRoot and ScriptAlias / ScriptAliasMatch targets

#  - flag VULNERABLE when Apache version is 2.2.2 and a ScriptAlias target resolves under DocumentRoot

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


param(
    [Parameter(Mandatory=$true)]
    [string]$ConfigPath
)

function Out-Result {
    param([string]$State, [int]$Code, [string]$Message)
    Write-Output $State
    if ($Message) { Write-Output $Message }
    exit $Code
}

function Normalize-PathString {
    param([string]$PathValue)
    if ([string]::IsNullOrWhiteSpace($PathValue)) { return $null }
    $p = $PathValue.Trim().Trim('"').Trim("'")
    $p = $p -replace '/', '\\'
    return $p.TrimEnd('\\')
}

function Try-Resolve-FullPath {
    param([string]$BaseDir, [string]$PathValue)
    try {
        $p = Normalize-PathString $PathValue
        if (-not $p) { return $null }
        if ([System.IO.Path]::IsPathRooted($p)) {
            return [System.IO.Path]::GetFullPath($p)
        }
        return [System.IO.Path]::GetFullPath((Join-Path $BaseDir $p))
    } catch {
        return $null
    }
}

if (-not $IsWindows) {
    Out-Result -State 'UNKNOWN' -Code 2 -Message 'This check is intended for Windows Apache hosts only.'
}

if (-not (Test-Path -LiteralPath $ConfigPath)) {
    Out-Result -State 'UNKNOWN' -Code 2 -Message "Config file not found: $ConfigPath"
}

$configDir = Split-Path -Parent $ConfigPath
$serverRoot = Split-Path -Parent $configDir

# Load main config plus simple Include / IncludeOptional entries.

$files = New-Object System.Collections.Generic.List[string]
$files.Add((Resolve-Path -LiteralPath $ConfigPath).Path)

try {
    $seedContent = Get-Content -LiteralPath $ConfigPath -ErrorAction Stop
    foreach ($line in $seedContent) {
        $trim = $line.Trim()
        if ($trim -match '^(?i)\s*Include(?:Optional)?\s+(.+)$') {
            $incRaw = $Matches[1].Trim().Trim('"').Trim("'")
            $incRaw = $incRaw -replace '/', '\\'
            $incPath = $incRaw
            if (-not [System.IO.Path]::IsPathRooted($incPath)) {
                $incPath = Join-Path $serverRoot $incPath
            }
            $expanded = Get-ChildItem -Path $incPath -File -ErrorAction SilentlyContinue | Select-Object -ExpandProperty FullName
            foreach ($f in $expanded) {
                if (-not $files.Contains($f)) { $files.Add($f) }
            }
        }
    }
} catch {
    Out-Result -State 'UNKNOWN' -Code 2 -Message "Unable to read config: $($_.Exception.Message)"
}

$allLines = foreach ($f in $files) {
    try { Get-Content -LiteralPath $f -ErrorAction Stop } catch { }
}

$allLines = $allLines | Where-Object { $_ -notmatch '^\s*#' }

# Extract DocumentRoot.

$documentRootRaw = $null
foreach ($line in $allLines) {
    if ($line -match '^(?i)\s*DocumentRoot\s+(.+)$') {
        $documentRootRaw = $Matches[1]
        break
    }
}

if (-not $documentRootRaw) {
    Out-Result -State 'UNKNOWN' -Code 2 -Message 'DocumentRoot not found in config.'
}

$documentRoot = Try-Resolve-FullPath -BaseDir $serverRoot -PathValue $documentRootRaw
if (-not $documentRoot) {
    Out-Result -State 'UNKNOWN' -Code 2 -Message 'Could not resolve DocumentRoot path.'
}

# Extract ScriptAlias targets.

$scriptTargets = New-Object System.Collections.Generic.List[string]
foreach ($line in $allLines) {
    if ($line -match '^(?i)\s*ScriptAlias\s+"?[^"]+"?\s+(.+)$') {
        $target = $Matches[1].Trim().Split()[0]
        $resolved = Try-Resolve-FullPath -BaseDir $serverRoot -PathValue $target
        if ($resolved) { $scriptTargets.Add($resolved) }
    } elseif ($line -match '^(?i)\s*ScriptAliasMatch\s+"?[^"]+"?\s+(.+)$') {
        $target = $Matches[1].Trim().Split()[0]
        $resolved = Try-Resolve-FullPath -BaseDir $serverRoot -PathValue $target
        if ($resolved) { $scriptTargets.Add($resolved) }
    }
}

if ($scriptTargets.Count -eq 0) {
    Out-Result -State 'PATCHED' -Code 0 -Message 'No ScriptAlias or ScriptAliasMatch directives found; this specific CVE pattern is not present.'
}

# Try to identify Apache version.

$httpdExe = $null
$binCandidate = Join-Path $serverRoot 'bin\httpd.exe'
if (Test-Path -LiteralPath $binCandidate) { $httpdExe = $binCandidate }

$versionString = $null
if ($httpdExe) {
    try {
        $vout = & $httpdExe -v 2>$null
        foreach ($line in $vout) {
            if ($line -match 'Apache/([0-9]+\.[0-9]+\.[0-9]+)') {
                $versionString = $Matches[1]
                break
            }
        }
    } catch { }
}

$underDocRoot = @()
foreach ($t in $scriptTargets | Select-Object -Unique) {
    if ($t.ToLowerInvariant().StartsWith($documentRoot.ToLowerInvariant() + '\\') -or $t.ToLowerInvariant() -eq $documentRoot.ToLowerInvariant()) {
        $underDocRoot += $t
    }
}

if ($underDocRoot.Count -eq 0) {
    Out-Result -State 'PATCHED' -Code 0 -Message 'ScriptAlias targets do not resolve under DocumentRoot; the known source-disclosure layout was not found.'
}

if (-not $versionString) {
    $msg = 'ScriptAlias target(s) under DocumentRoot detected, but Apache version could not be confirmed. Review manually. Paths: ' + ($underDocRoot -join ', ')
    Out-Result -State 'UNKNOWN' -Code 2 -Message $msg
}

if ($versionString -eq '2.2.2') {
    $msg = 'Apache 2.2.2 on Windows with ScriptAlias target(s) under DocumentRoot detected. Paths: ' + ($underDocRoot -join ', ')
    Out-Result -State 'VULNERABLE' -Code 1 -Message $msg
}

$msg = "Apache version $versionString detected. Risky layout exists (ScriptAlias under DocumentRoot), but the canonical CVE text points to 2.2.2 on Windows. Treat config as unsafe even if the precise CVE may not apply. Paths: " + ($underDocRoot -join ', ')
Out-Result -State 'PATCHED' -Code 0 -Message $msg