MySQL User-Defined Functions Multiple Vulnerabilities

#!/usr/bin/env python3
# check_mysql_udf_17698.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import argparse
import subprocess
import sys
import re

SAFE_ADMIN_USERS = {
    'root@localhost',
    'mysql.session@localhost',
    'mysql.sys@localhost',
    'mysql.infoschema@localhost',
}

def run_mysql(mysql_bin, conn_args, sql):
    cmd = [mysql_bin, '--batch', '--raw', '--skip-column-names'] + conn_args + ['-e', sql]
    proc = subprocess.run(cmd, capture_output=True, text=True)
    if proc.returncode != 0:
        raise RuntimeError(proc.stderr.strip() or 'mysql command failed')
    return proc.stdout.strip()


def parse_version(v):
    m = re.match(r'^(\d+)\.(\d+)\.(\d+)', v)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def version_lt(a, b):
    return a < b


def version_in_legacy_vuln_range(vt):
    # Legacy fixed versions from MySQL advisories/bugs for related UDF issues.
    if vt is None:
        return False
    major, minor, patch = vt
    if (major, minor) == (4, 0) and version_lt(vt, (4, 0, 25)):
        return True
    if (major, minor) == (4, 1) and version_lt(vt, (4, 1, 13)):
        return True
    if (major, minor) == (5, 0) and version_lt(vt, (5, 0, 8)):
        return True
    return False


def main():
    ap = argparse.ArgumentParser(description='Assess Tenable 17698 / MySQL UDF risk')
    ap.add_argument('--mysql', required=True, help='Path to mysql CLI')
    ap.add_argument('-h', '--host', dest='host', help='MySQL host')
    ap.add_argument('-P', '--port', dest='port', help='MySQL port')
    ap.add_argument('-u', '--user', dest='user', help='MySQL user')
    ap.add_argument('-p', '--password', dest='password', help='MySQL password')
    ap.add_argument('--login-path', dest='login_path', help='MySQL login-path to use')
    args = ap.parse_args()

    conn_args = []
    if args.host:
        conn_args += ['-h', args.host]
    if args.port:
        conn_args += ['-P', str(args.port)]
    if args.user:
        conn_args += ['-u', args.user]
    if args.password is not None:
        conn_args += [f'-p{args.password}']
    if args.login_path:
        conn_args += [f'--login-path={args.login_path}']

    try:
        info = run_mysql(
            args.mysql,
            conn_args,
            "SELECT VERSION(), @@version_compile_os, @@version_comment;"
        )
        parts = info.split('\t')
        if len(parts) < 3:
            print('UNKNOWN - could not parse VERSION()/OS data')
            sys.exit(2)

        version_str, compile_os, version_comment = parts[0], parts[1], parts[2]
        version_tuple = parse_version(version_str)
        os_text = f'{compile_os} {version_comment}'.lower()
        is_windows = 'win' in os_text

        grants = run_mysql(
            args.mysql,
            conn_args,
            "SELECT CONCAT(User,'@',Host), Table_priv FROM mysql.tables_priv WHERE Db='mysql' AND Table_name='func';"
        )

        risky_principals = []
        if grants:
            for line in grants.splitlines():
                cols = line.split('\t')
                if len(cols) != 2:
                    continue
                principal, privs = cols[0].strip(), cols[1].strip().upper()
                if 'INSERT' in privs and principal not in SAFE_ADMIN_USERS:
                    risky_principals.append(principal)

        # Decision logic:
        # - Non-Windows: treat the CVE-2005-2572 path as not applicable.
        # - Windows + risky mysql.func grants: vulnerable from a hardening standpoint.
        # - Windows + ancient legacy branches: vulnerable due to the old UDF bug family.
        if not is_windows:
            print(f'PATCHED - server is not Windows-like ({compile_os} / {version_comment}); CVE-2005-2572 main path is not applicable')
            sys.exit(0)

        if risky_principals:
            print('VULNERABLE - Windows MySQL with non-admin INSERT privilege on mysql.func: ' + ', '.join(risky_principals))
            sys.exit(1)

        if version_in_legacy_vuln_range(version_tuple):
            print(f'VULNERABLE - Windows MySQL version {version_str} falls in legacy UDF vulnerable ranges')
            sys.exit(1)

        print(f'PATCHED - Windows MySQL version {version_str} is not in legacy fixed ranges and no risky mysql.func INSERT grants were found')
        sys.exit(0)

    except Exception as e:
        print(f'UNKNOWN - {e}')
        sys.exit(2)

if __name__ == '__main__':
    main()