Apache 2

#!/usr/bin/env bash
# check_apache_2459.sh
# Detect likely exposure for Tenable plugin 192923 (Apache httpd < 2.4.59 bundle)
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

APACHE_BIN="${1:-}"
OS_ID=""
OS_VERSION_ID=""
STATUS="UNKNOWN"
DETAILS=()

add_detail() {
  DETAILS+=("$1")
}

version_lt() {
  # returns 0 if $1 < $2
  [ "$(printf '%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ]
}

version_ge() {
  # returns 0 if $1 >= $2
  ! version_lt "$1" "$2"
}

load_os_release() {
  if [ -r /etc/os-release ]; then
    # shellcheck disable=SC1091
    . /etc/os-release
    OS_ID="${ID:-}"
    OS_VERSION_ID="${VERSION_ID:-}"
  fi
}

find_apache_bin() {
  if [ -n "$APACHE_BIN" ] && [ -x "$APACHE_BIN" ]; then
    return 0
  fi
  for b in /usr/sbin/httpd /usr/sbin/apache2 /usr/local/apache2/bin/httpd $(command -v httpd 2>/dev/null) $(command -v apache2 2>/dev/null); do
    if [ -n "$b" ] && [ -x "$b" ]; then
      APACHE_BIN="$b"
      return 0
    fi
  done
  return 1
}

get_upstream_version() {
  local out ver
  out="$($APACHE_BIN -v 2>/dev/null || true)"
  ver="$(printf '%s\n' "$out" | sed -n 's/^Server version: .*\/\([0-9][0-9.]*\).*/\1/p' | head -n1)"
  printf '%s' "$ver"
}

http2_enabled() {
  local ctl out
  for ctl in apachectl apache2ctl "$APACHE_BIN"; do
    if command -v "$ctl" >/dev/null 2>&1 || [ -x "$ctl" ]; then
      out="$($ctl -M 2>/dev/null || true)"
      if printf '%s' "$out" | grep -Eq 'http2_module|mod_http2'; then
        return 0
      fi
    fi
  done
  return 1
}

check_dpkg_backport() {
  if ! command -v dpkg-query >/dev/null 2>&1 || ! command -v dpkg >/dev/null 2>&1; then
    return 2
  fi

  local pkgver fixed
  pkgver="$(dpkg-query -W -f='${Version}' apache2 2>/dev/null || true)"
  [ -n "$pkgver" ] || return 2
  add_detail "dpkg apache2=$pkgver"

  case "$OS_VERSION_ID" in
    10) fixed='2.4.59-1~deb10u1' ;;
    11) fixed='2.4.59-1~deb11u1' ;;
    12) fixed='2.4.59-1~deb12u1' ;;
    *) return 2 ;;
  esac

  if dpkg --compare-versions "$pkgver" ge "$fixed"; then
    STATUS="PATCHED"
    add_detail "Debian backport threshold met ($fixed)"
    return 0
  else
    STATUS="VULNERABLE"
    add_detail "Debian package below fixed threshold ($fixed)"
    return 1
  fi
}

check_rpm_backport() {
  if ! command -v rpm >/dev/null 2>&1; then
    return 2
  fi

  local pkgver
  pkgver="$(rpm -q --qf '%{VERSION}-%{RELEASE}' httpd24 2>/dev/null || true)"
  if [ -n "$pkgver" ] && [ "$pkgver" != 'package httpd24 is not installed' ]; then
    add_detail "rpm httpd24=$pkgver"
    case "$OS_ID" in
      amzn)
        if printf '%s\n' "$pkgver" | grep -Eq '^2\.4\.59-1\.102\.amzn1'; then
          STATUS="PATCHED"
          add_detail "Amazon Linux 1 httpd24 fixed build detected"
          return 0
        fi
        ;;
    esac
  fi

  pkgver="$(rpm -q --qf '%{VERSION}-%{RELEASE}' httpd 2>/dev/null || true)"
  if [ -n "$pkgver" ] && ! printf '%s' "$pkgver" | grep -q '^package '; then
    add_detail "rpm httpd=$pkgver"
  fi

  return 2
}

main() {
  load_os_release

  if ! find_apache_bin; then
    echo "UNKNOWN - Apache binary not found"
    exit 2
  fi

  add_detail "apache_bin=$APACHE_BIN"
  [ -n "$OS_ID" ] && add_detail "os=$OS_ID $OS_VERSION_ID"

  local ver
  ver="$(get_upstream_version)"
  if [ -z "$ver" ]; then
    echo "UNKNOWN - Could not determine Apache version (${DETAILS[*]})"
    exit 2
  fi
  add_detail "upstream_version=$ver"

  # First handle known distro backports so we do not false-positive on package-maintained builds.
  check_dpkg_backport || true
  if [ "$STATUS" = "PATCHED" ]; then
    echo "PATCHED - ${DETAILS[*]}"
    exit 0
  elif [ "$STATUS" = "VULNERABLE" ]; then
    echo "VULNERABLE - ${DETAILS[*]}"
    exit 1
  fi

  check_rpm_backport || true
  if [ "$STATUS" = "PATCHED" ]; then
    echo "PATCHED - ${DETAILS[*]}"
    exit 0
  fi

  # Upstream version logic
  if version_ge "$ver" "2.4.59"; then
    echo "PATCHED - ${DETAILS[*]}"
    exit 0
  fi

  if version_ge "$ver" "2.4.17" && version_lt "$ver" "2.4.59"; then
    if http2_enabled; then
      add_detail "http2_module=enabled"
    else
      add_detail "http2_module=not-detected"
    fi
    echo "VULNERABLE - ${DETAILS[*]}"
    exit 1
  fi

  echo "UNKNOWN - Version outside expected vulnerable range or unsupported packaging (${DETAILS[*]})"
  exit 2
}

main "$@"