Apache 2

#!/usr/bin/env bash
# verify_mod_lua_193424.sh
# Checks whether Apache hosts are plausibly exposed to Tenable plugin 193424
# Logic:
#   PATCHED    -> package/backport appears fixed, OR Apache >= 2.4.54, OR mod_lua not loaded
#   VULNERABLE -> Apache <= 2.4.53, mod_lua loaded, and risky Lua indicators are found
#   UNKNOWN    -> insufficient evidence / package backport uncertain / mod_lua loaded without obvious risky code
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

status="UNKNOWN"
reason="No conclusion yet"

have_cmd() { command -v "$1" >/dev/null 2>&1; }

version_ge() {
  # returns 0 if $1 >= $2 using sort -V
  [ "$(printf '%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

APACHECTL=""
for c in apache2ctl apachectl httpd; do
  if have_cmd "$c"; then APACHECTL="$c"; break; fi
done

if [ -z "$APACHECTL" ]; then
  echo "UNKNOWN - Apache control binary not found"
  exit 2
fi

VER_RAW="$($APACHECTL -v 2>/dev/null | grep -Eo 'Apache/[0-9]+\.[0-9]+\.[0-9]+' | head -n1 | cut -d/ -f2)"
if [ -z "$VER_RAW" ]; then
  echo "UNKNOWN - Could not determine Apache version"
  exit 2
fi

MODULES="$($APACHECTL -M 2>/dev/null || true)"
if ! printf '%s\n' "$MODULES" | grep -Eq 'lua_module'; then
  echo "PATCHED - mod_lua is not loaded on this host; plugin 193424 is not practically reachable"
  exit 0
fi

# Distro backport checks first
if have_cmd dpkg-query; then
  PKG_VER="$(dpkg-query -W -f='${Version}' apache2 2>/dev/null || true)"
  if [ -n "$PKG_VER" ]; then
    if dpkg --compare-versions "$PKG_VER" ge "2.4.54-1~deb11u1"; then
      echo "PATCHED - Debian-family apache2 package version suggests backported fix: $PKG_VER"
      exit 0
    fi
    if dpkg --compare-versions "$PKG_VER" ge "2.4.52-1ubuntu4.1"; then
      echo "PATCHED - Ubuntu-family apache2 package version suggests backported fix: $PKG_VER"
      exit 0
    fi
  fi
fi

if have_cmd rpm; then
  RPM_NAME="$(rpm -q httpd 2>/dev/null || true)"
  if [ -n "$RPM_NAME" ] && [ "$RPM_NAME" != "package httpd is not installed" ]; then
    if rpm -q --changelog httpd 2>/dev/null | grep -Eq 'CVE-2022-29404|CVE-2022-30556|CVE-2022-28614|CVE-2022-28615'; then
      echo "PATCHED - RPM changelog shows relevant backport(s) for mod_lua issue set"
      exit 0
    fi
  fi
fi

# Upstream version check
if version_ge "$VER_RAW" "2.4.54"; then
  echo "PATCHED - Upstream Apache version is $VER_RAW (>= 2.4.54)"
  exit 0
fi

CFG_DIRS="/etc/httpd /etc/apache2 /usr/local/apache2/conf /opt"
TMP_MATCHES="$(mktemp 2>/dev/null || echo /tmp/mod_lua_193424.$$)"
: > "$TMP_MATCHES"

# Search config and Lua sources for risky indicators
find $CFG_DIRS -type f \( -name '*.conf' -o -name '*.lua' -o -name '*.inc' \) 2>/dev/null | while read -r f; do
  grep -En 'Lua(MapHandler|Hook|QuickHandler|Scope)|r:parsebody\(0\)|r:wsread\(|r:puts\(' "$f" 2>/dev/null && echo "FILE::$f" >> "$TMP_MATCHES"
done >/dev/null 2>&1

# Re-run with explicit output capture because subshell piping above hides matches on some shells
MATCH_OUTPUT="$(grep -REn 'Lua(MapHandler|Hook|QuickHandler|Scope)|r:parsebody\(0\)|r:wsread\(|r:puts\(' /etc/httpd /etc/apache2 /usr/local/apache2/conf /opt 2>/dev/null | head -n 20 || true)"

if [ -n "$MATCH_OUTPUT" ]; then
  if printf '%s\n' "$MATCH_OUTPUT" | grep -Eq 'r:parsebody\(0\)|r:wsread\('; then
    echo "VULNERABLE - Apache $VER_RAW with mod_lua loaded and risky indicators found"
    printf '%s\n' "$MATCH_OUTPUT" | sed 's/^/  /'
    exit 1
  fi
  echo "UNKNOWN - Apache $VER_RAW with mod_lua loaded; Lua handlers present but no direct smoking-gun call found"
  printf '%s\n' "$MATCH_OUTPUT" | sed 's/^/  /'
  exit 2
fi

echo "UNKNOWN - Apache $VER_RAW is older than 2.4.54 and mod_lua is loaded, but no exposed risky handler usage was identified by grep"
exit 2