Apache 2

#!/usr/bin/env bash
# verify_apache_2458.sh
# Purpose: assess exposure to Apache HTTP Server issues fixed in 2.4.58
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

status="UNKNOWN"
reason=""

have_cmd() { command -v "$1" >/dev/null 2>&1; }

ver_ge() {
  # returns 0 if $1 >= $2 using sort -V
  [ "$(printf '%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

ver_gt() {
  [ "$1" != "$2" ] && ver_ge "$1" "$2"
}

ver_lt() {
  ! ver_ge "$1" "$2"
}

get_httpd_info() {
  local out=""
  if have_cmd apachectl; then
    out="$(apachectl -V 2>/dev/null || true)"
    if [ -n "$out" ]; then printf '%s' "$out"; return 0; fi
  fi
  if have_cmd httpd; then
    out="$(httpd -V 2>/dev/null || true)"
    if [ -n "$out" ]; then printf '%s' "$out"; return 0; fi
  fi
  if have_cmd apache2ctl; then
    out="$(apache2ctl -V 2>/dev/null || true)"
    if [ -n "$out" ]; then printf '%s' "$out"; return 0; fi
  fi
  return 1
}

get_modules() {
  local out=""
  if have_cmd apachectl; then
    out="$(apachectl -M 2>/dev/null || true)"
    if [ -n "$out" ]; then printf '%s' "$out"; return 0; fi
  fi
  if have_cmd httpd; then
    out="$(httpd -M 2>/dev/null || true)"
    if [ -n "$out" ]; then printf '%s' "$out"; return 0; fi
  fi
  if have_cmd apache2ctl; then
    out="$(apache2ctl -M 2>/dev/null || true)"
    if [ -n "$out" ]; then printf '%s' "$out"; return 0; fi
  fi
  return 1
}

HTTPD_INFO="$(get_httpd_info || true)"
MODULES="$(get_modules || true)"

BASE_VER=""
if [ -n "$HTTPD_INFO" ]; then
  BASE_VER="$(printf '%s\n' "$HTTPD_INFO" | sed -n 's/.*Server version: Apache\/\([0-9][0-9.]*\).*/\1/p' | head -n1)"
fi

HAS_HTTP2=0
HAS_MACRO=0
printf '%s\n' "$MODULES" | grep -Eq 'http2_module|mod_http2' && HAS_HTTP2=1
printf '%s\n' "$MODULES" | grep -Eq 'macro_module|mod_macro' && HAS_MACRO=1

# Check distro package versions first where possible, because backports matter.
if have_cmd dpkg-query; then
  PKG_VER="$(dpkg-query -W -f='${Version}' apache2 2>/dev/null || true)"
  if [ -n "$PKG_VER" ]; then
    . /etc/os-release 2>/dev/null || true
    UBUNTU_CODENAME="${VERSION_CODENAME:-}"

    case "$UBUNTU_CODENAME" in
      jammy)
        if dpkg --compare-versions "$PKG_VER" ge "2.4.52-1ubuntu4.7"; then
          echo "PATCHED - Ubuntu jammy apache2 package $PKG_VER includes fixes/backports relevant to 2.4.58 issues."
          exit 0
        fi
        ;;
      focal)
        if dpkg --compare-versions "$PKG_VER" ge "2.4.41-4ubuntu3.15"; then
          echo "PATCHED - Ubuntu focal apache2 package $PKG_VER includes fixes/backports relevant to 2.4.58 issues."
          exit 0
        fi
        ;;
      mantic)
        if dpkg --compare-versions "$PKG_VER" ge "2.4.57-2ubuntu2.1"; then
          echo "PATCHED - Ubuntu mantic apache2 package $PKG_VER includes fixes/backports relevant to 2.4.58 issues."
          exit 0
        fi
        ;;
      lunar)
        if dpkg --compare-versions "$PKG_VER" ge "2.4.55-1ubuntu2.1"; then
          echo "PATCHED - Ubuntu lunar apache2 package $PKG_VER includes fixes/backports relevant to 2.4.58 issues."
          exit 0
        fi
        ;;
    esac

    # Debian bookworm/bullseye fixed in 2.4.59-1~deb12u1 / 2.4.59-1~deb11u1.
    if printf '%s' "$PKG_VER" | grep -q 'deb12'; then
      if dpkg --compare-versions "$PKG_VER" ge "2.4.59-1~deb12u1"; then
        echo "PATCHED - Debian bookworm apache2 package $PKG_VER includes fixes/backports relevant to 2.4.58 issues."
        exit 0
      fi
    fi
    if printf '%s' "$PKG_VER" | grep -q 'deb11'; then
      if dpkg --compare-versions "$PKG_VER" ge "2.4.59-1~deb11u1"; then
        echo "PATCHED - Debian bullseye apache2 package $PKG_VER includes fixes/backports relevant to 2.4.58 issues."
        exit 0
      fi
    fi
  fi
fi

# Fall back to upstream-style version logic.
if [ -z "$BASE_VER" ]; then
  echo "UNKNOWN - Could not determine Apache httpd version from apachectl/httpd."
  exit 2
fi

if [ "$HAS_HTTP2" -eq 0 ] && [ "$HAS_MACRO" -eq 0 ]; then
  echo "PATCHED - Neither mod_http2 nor mod_macro appears loaded; the 2.4.58 issues tracked by this check are not reachable in the active config."
  exit 0
fi

VULN=0
DETAILS=""

if [ "$HAS_HTTP2" -eq 1 ]; then
  if ver_ge "$BASE_VER" "2.4.17" && ver_lt "$BASE_VER" "2.4.58"; then
    VULN=1
    DETAILS="$DETAILS mod_http2-loaded: vulnerable to CVE-2023-45802;"
  fi
  if ver_ge "$BASE_VER" "2.4.55" && ver_lt "$BASE_VER" "2.4.58"; then
    VULN=1
    DETAILS="$DETAILS mod_http2-loaded: vulnerable to CVE-2023-43622;"
  fi
fi

if [ "$HAS_MACRO" -eq 1 ]; then
  if ver_lt "$BASE_VER" "2.4.58"; then
    VULN=1
    DETAILS="$DETAILS mod_macro-loaded: vulnerable to CVE-2023-31122;"
  fi
fi

if [ "$VULN" -eq 1 ]; then
  echo "VULNERABLE - Apache $BASE_VER.$DETAILS"
  exit 1
fi

if ver_ge "$BASE_VER" "2.4.58"; then
  echo "PATCHED - Upstream Apache version $BASE_VER is not below 2.4.58."
  exit 0
fi

echo "UNKNOWN - Apache $BASE_VER is older than 2.4.58, but loaded-module or distro-backport evidence is inconclusive."
exit 2