Apache 2

# check-cve-2022-28330.ps1

# CVE-2022-28330 verifier for Windows Apache httpd

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


param(
    [string]$ApacheRoot = "C:\Apache24"
)

function Write-Result {
    param(
        [string]$Status,
        [string]$Message,
        [int]$Code
    )
    Write-Output "$Status - $Message"
    exit $Code
}

function Get-HttpdPath {
    param([string]$Root)

    $candidates = @(
        (Join-Path $Root 'bin\httpd.exe'),
        'C:\Apache24\bin\httpd.exe',
        'C:\Program Files\Apache Group\Apache2\bin\httpd.exe',
        'C:\Program Files\Apache24\bin\httpd.exe'
    )

    foreach ($p in $candidates) {
        if (Test-Path $p) { return $p }
    }

    $cmd = Get-Command httpd.exe -ErrorAction SilentlyContinue
    if ($cmd) { return $cmd.Source }

    return $null
}

function Get-ApacheVersion {
    param([string]$HttpdExe)

    try {
        $out = & $HttpdExe -v 2>$null
        $text = ($out | Out-String)
        if ($text -match 'Apache\/([0-9]+)\.([0-9]+)\.([0-9]+)') {
            return [PSCustomObject]@{
                Raw = $Matches[0]
                Version = [version]("{0}.{1}.{2}" -f $Matches[1], $Matches[2], $Matches[3])
            }
        }
    } catch {}

    return $null
}

function Test-ModIsapiLoaded {
    param([string]$HttpdExe)

    try {
        $mods = & $HttpdExe -M 2>$null
        $modText = ($mods | Out-String)
        if ($modText -match 'isapi_module') { return $true }
    } catch {}

    return $false
}

function Get-ConfigFiles {
    param([string]$Root)

    $files = @()
    $confRoot = Join-Path $Root 'conf'
    if (Test-Path $confRoot) {
        $files += Get-ChildItem -Path $confRoot -Recurse -File -Include *.conf -ErrorAction SilentlyContinue
    }
    return $files | Select-Object -ExpandProperty FullName -Unique
}

function Test-ModIsapiConfigured {
    param([string[]]$ConfigFiles)

    $loadFound = $false
    $handlerFound = $false

    foreach ($file in $ConfigFiles) {
        try {
            $content = Get-Content -Path $file -Raw -ErrorAction Stop
            if ($content -match '(?im)^\s*LoadModule\s+isapi_module\b') { $loadFound = $true }
            if ($content -match '(?im)^\s*AddHandler\s+isapi-handler\b') { $handlerFound = $true }
        } catch {
            continue
        }
    }

    return [PSCustomObject]@{
        LoadModule = $loadFound
        AddHandler = $handlerFound
        Effective = ($loadFound -or $handlerFound)
    }
}

$httpd = Get-HttpdPath -Root $ApacheRoot
if (-not $httpd) {
    Write-Result -Status 'UNKNOWN' -Message 'httpd.exe not found; supply -ApacheRoot' -Code 2
}

$versionInfo = Get-ApacheVersion -HttpdExe $httpd
if (-not $versionInfo) {
    Write-Result -Status 'UNKNOWN' -Message "Could not determine Apache version from $httpd" -Code 2
}

$fixedVersion = [version]'2.4.54'
$configFiles = Get-ConfigFiles -Root (Split-Path (Split-Path $httpd -Parent) -Parent)
$configCheck = Test-ModIsapiConfigured -ConfigFiles $configFiles
$moduleLoaded = Test-ModIsapiLoaded -HttpdExe $httpd
$modIsapiEffective = ($moduleLoaded -or $configCheck.Effective)

if ($versionInfo.Version -ge $fixedVersion) {
    Write-Result -Status 'PATCHED' -Message ("Apache version {0} is >= 2.4.54" -f $versionInfo.Version) -Code 0
}

if ($versionInfo.Version -lt $fixedVersion -and $modIsapiEffective) {
    $details = @()
    if ($moduleLoaded) { $details += 'module loaded' }
    if ($configCheck.LoadModule) { $details += 'LoadModule present' }
    if ($configCheck.AddHandler) { $details += 'ISAPI handler mapping present' }
    Write-Result -Status 'VULNERABLE' -Message ("Apache version {0} with mod_isapi indicators: {1}" -f $versionInfo.Version, ($details -join ', ')) -Code 1
}

Write-Result -Status 'PATCHED' -Message ("Apache version {0} is old, but no mod_isapi evidence found; vulnerable code likely not in execution path" -f $versionInfo.Version) -Code 0