PHP mb_send_mail

#!/usr/bin/env bash
# verify_cve_2006_1014.sh
# Check likely exposure to CVE-2006-1014 / Tenable plugin 17716
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

if ! command -v php >/dev/null 2>&1; then
  echo "UNKNOWN: php CLI not found"
  exit 2
fi

PHP_VERSION_RAW="$(php -r 'echo PHP_VERSION;' 2>/dev/null)"
if [ -z "$PHP_VERSION_RAW" ]; then
  echo "UNKNOWN: unable to determine PHP version"
  exit 2
fi

SENDMAIL_PATH="$(php -r 'echo (string) ini_get("sendmail_path");' 2>/dev/null)"
if [ -z "$SENDMAIL_PATH" ]; then
  SENDMAIL_PATH="(empty)"
fi

# Very old upstream fixed points commonly referenced for this issue.
# Note: distro backports may make version-only checks pessimistic.
php -r '
$v = PHP_VERSION;
function lt($a,$b){ return version_compare($a,$b,"<"); }
if (preg_match("/^4\./", $v)) {
  exit(lt($v,"4.4.2") ? 10 : 0);
}
if (preg_match("/^5\./", $v)) {
  exit(lt($v,"5.1.4") ? 10 : 0);
}
exit(0);
' >/dev/null 2>&1
VER_RC=$?

VERSION_STATE="patched-or-newer"
if [ "$VER_RC" -eq 10 ]; then
  VERSION_STATE="legacy-vulnerable-range"
fi

SEARCH_DIRS="$*"
if [ -z "$SEARCH_DIRS" ]; then
  for d in /var/www /srv/www /usr/share/nginx/html /opt /home; do
    [ -d "$d" ] && SEARCH_DIRS="$SEARCH_DIRS $d"
  done
fi

FOUND_CALLS=0
FOUND_RISKY=0
TMP_OUT="$(mktemp 2>/dev/null || echo /tmp/cve_2006_1014.$$)"
: > "$TMP_OUT"

for d in $SEARCH_DIRS; do
  [ -d "$d" ] || continue
  grep -RInE --include='*.php' 'mb_send_mail\s*\(' "$d" 2>/dev/null >> "$TMP_OUT" || true
  grep -RInE --include='*.php' 'mb_send_mail\s*\([^\)]*,[^\)]*,[^\)]*,[^\)]*,\s*\$' "$d" 2>/dev/null >> "$TMP_OUT.risky" || true
  grep -RInE --include='*.php' 'mb_send_mail\s*\([^\)]*,[^\)]*,[^\)]*,[^\)]*,\s*(\$_GET|\$_POST|\$_REQUEST|\$_COOKIE|\$_SERVER)' "$d" 2>/dev/null >> "$TMP_OUT.risky" || true
done

if [ -s "$TMP_OUT" ]; then
  FOUND_CALLS=1
fi
if [ -s "$TMP_OUT.risky" ]; then
  FOUND_RISKY=1
fi

USES_SENDMAIL=0
case "$SENDMAIL_PATH" in
  *sendmail*|*postfix*|*exim*|*msmtp*) USES_SENDMAIL=1 ;;
esac

if [ "$VERSION_STATE" = "legacy-vulnerable-range" ] && [ "$USES_SENDMAIL" -eq 1 ] && [ "$FOUND_RISKY" -eq 1 ]; then
  echo "VULNERABLE: PHP $PHP_VERSION_RAW in legacy range, sendmail_path='$SENDMAIL_PATH', risky mb_send_mail() usage found"
  rm -f "$TMP_OUT" "$TMP_OUT.risky"
  exit 1
fi

if [ "$VERSION_STATE" = "patched-or-newer" ] && [ "$FOUND_RISKY" -eq 0 ]; then
  echo "PATCHED: PHP $PHP_VERSION_RAW is outside common vulnerable upstream range and no risky mb_send_mail() usage was found"
  rm -f "$TMP_OUT" "$TMP_OUT.risky"
  exit 0
fi

if [ "$VERSION_STATE" = "legacy-vulnerable-range" ] && [ "$FOUND_CALLS" -eq 0 ]; then
  echo "UNKNOWN: PHP $PHP_VERSION_RAW is in a legacy range, but no mb_send_mail() calls were found in scanned paths; check other code locations and package backports"
  rm -f "$TMP_OUT" "$TMP_OUT.risky"
  exit 2
fi

if [ "$VERSION_STATE" = "legacy-vulnerable-range" ] && [ "$USES_SENDMAIL" -eq 0 ]; then
  echo "UNKNOWN: legacy PHP version detected, but sendmail_path='$SENDMAIL_PATH' does not clearly indicate a vulnerable local sendmail-style transport"
  rm -f "$TMP_OUT" "$TMP_OUT.risky"
  exit 2
fi

if [ "$FOUND_RISKY" -eq 1 ]; then
  echo "UNKNOWN: risky mb_send_mail() pattern found, but runtime/package state needs manual validation (backports possible)"
  rm -f "$TMP_OUT" "$TMP_OUT.risky"
  exit 2
fi

echo "UNKNOWN: partial evidence only; PHP=$PHP_VERSION_RAW sendmail_path='$SENDMAIL_PATH' mb_send_mail_calls=$FOUND_CALLS risky_calls=$FOUND_RISKY"
rm -f "$TMP_OUT" "$TMP_OUT.risky"
exit 2