Apache 2.4.x < 2.4.54 Multiple Vulnerabilities

#!/usr/bin/env bash
# check-cve-2022-30522.sh
# Determine practical exposure to Apache HTTP Server CVE-2022-30522
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

CVE="CVE-2022-30522"
APACHE_CTL=""
APACHE_BIN=""
CONFIG_ROOTS=(/etc/httpd /etc/apache2 /usr/local/apache2/conf)

find_apache() {
  for x in apachectl apache2ctl; do
    if command -v "$x" >/dev/null 2>&1; then
      APACHE_CTL="$(command -v "$x")"
      break
    fi
  done
  for x in httpd apache2 apache; do
    if command -v "$x" >/dev/null 2>&1; then
      APACHE_BIN="$(command -v "$x")"
      break
    fi
  done
}

ver_ge() {
  # returns 0 if $1 >= $2
  [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

ver_gt() {
  [ "$1" != "$2" ] && ver_ge "$1" "$2"
}

get_version() {
  local out ver
  out=""
  if [ -n "$APACHE_BIN" ]; then
    out="$($APACHE_BIN -v 2>/dev/null || true)"
  fi
  if [ -z "$out" ] && [ -n "$APACHE_CTL" ]; then
    out="$($APACHE_CTL -v 2>/dev/null || true)"
  fi
  ver="$(printf '%s' "$out" | sed -n 's/.*Apache\/\([0-9][0-9.]*\).*/\1/p' | head -n1)"
  printf '%s' "$ver"
}

has_backport_fix() {
  # Debian/Ubuntu package changelog
  if command -v dpkg-query >/dev/null 2>&1; then
    if dpkg-query -W apache2 >/dev/null 2>&1; then
      if zgrep -qi "$CVE" /usr/share/doc/apache2/changelog.Debian.gz 2>/dev/null; then
        return 0
      fi
      if grep -Rqi "$CVE" /usr/share/doc/apache2* 2>/dev/null; then
        return 0
      fi
    fi
  fi

  # RPM package changelog
  if command -v rpm >/dev/null 2>&1; then
    if rpm -q httpd >/dev/null 2>&1; then
      if rpm -q --changelog httpd 2>/dev/null | grep -qi "$CVE"; then
        return 0
      fi
    fi
  fi

  return 1
}

mod_sed_loaded() {
  local mods
  mods=""
  if [ -n "$APACHE_CTL" ]; then
    mods="$($APACHE_CTL -M 2>/dev/null || true)"
  elif [ -n "$APACHE_BIN" ]; then
    mods="$($APACHE_BIN -M 2>/dev/null || true)"
  fi
  printf '%s' "$mods" | grep -Eq '(^|[[:space:]])sed_module[[:space:]]' 
}

sed_directives_present() {
  local root found=1
  for root in "${CONFIG_ROOTS[@]}"; do
    if [ -d "$root" ]; then
      if grep -RIEq '^\s*(InputSed|OutputSed|AddInputFilter\s+Sed\b|AddOutputFilter\s+Sed\b)' "$root" 2>/dev/null; then
        return 0
      fi
    fi
  done
  return 1
}

say() {
  printf '%s\n' "$1"
}

find_apache

if [ -z "$APACHE_BIN" ] && [ -z "$APACHE_CTL" ]; then
  say "UNKNOWN: Apache binary/control utility not found"
  exit 2
fi

VERSION="$(get_version)"
if [ -z "$VERSION" ]; then
  say "UNKNOWN: Could not determine Apache version"
  exit 2
fi

# First, honor distro backport evidence.
if has_backport_fix; then
  say "PATCHED: Package metadata/changelog references ${CVE}; likely fixed via distro backport"
  exit 0
fi

# Upstream logic for CVE-2022-30522 is much narrower than '<2.4.54'.
if ver_gt "$VERSION" "2.4.53"; then
  say "PATCHED: Apache version ${VERSION} is newer than upstream vulnerable 2.4.53"
  exit 0
fi

if [ "$VERSION" != "2.4.53" ]; then
  say "PATCHED: Upstream CVE-2022-30522 is tied to 2.4.53 behavior, not generic older Apache"
  exit 0
fi

# Exactly 2.4.53: now check practical exposure.
if mod_sed_loaded; then
  if sed_directives_present; then
    say "VULNERABLE: Apache 2.4.53 with mod_sed loaded and active Sed directives present"
    exit 1
  else
    say "UNKNOWN: Apache 2.4.53 has mod_sed loaded, but no active Sed directives were found in common config roots"
    exit 2
  fi
else
  say "PATCHED: Apache 2.4.53 detected, but mod_sed is not loaded so the CVE-2022-30522 code path is not active"
  exit 0
fi