Apache 2

#!/usr/bin/env python3
# Apache 2.4.60/2.4.61 check for Tenable plugin 202577 context
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import re
import sys
import glob
import shutil
import platform
import subprocess
from pathlib import Path

EXIT_PATCHED = 0
EXIT_VULN = 1
EXIT_UNKNOWN = 2


def run(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=15)
        return p.returncode, (p.stdout or '') + (p.stderr or '')
    except Exception:
        return 999, ''


def find_httpd_binary():
    candidates = []
    if platform.system().lower().startswith('win'):
        candidates += [
            'httpd.exe',
            r'C:\\Apache24\\bin\\httpd.exe',
            r'C:\\Apache2\\bin\\httpd.exe',
        ]
    else:
        candidates += ['apache2ctl', 'apachectl', 'httpd', 'apache2']
        candidates += ['/usr/sbin/apache2ctl', '/usr/sbin/apachectl', '/usr/sbin/httpd', '/usr/sbin/apache2']

    for c in candidates:
        if os.path.isabs(c) and os.path.exists(c):
            return c
        found = shutil.which(c)
        if found:
            return found
    return None


def parse_version(text):
    m = re.search(r'Apache/(\d+)\.(\d+)\.(\d+)', text)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def get_httpd_info(bin_path):
    version_out = ''
    v_out = ''
    for args in ([bin_path, '-v'], [bin_path, '-V']):
        rc, out = run(args)
        if args[-1] == '-v':
            version_out = out
        else:
            v_out = out
    return version_out, v_out


def parse_httpd_root(v_out):
    m = re.search(r'HTTPD_ROOT="([^"]+)"', v_out)
    return m.group(1) if m else None


def gather_config_candidates(v_out):
    paths = set()
    sysname = platform.system().lower()

    m = re.search(r'SERVER_CONFIG_FILE="([^"]+)"', v_out)
    server_cfg = m.group(1) if m else None
    httpd_root = parse_httpd_root(v_out)

    if server_cfg:
        p = Path(server_cfg)
        if not p.is_absolute() and httpd_root:
            p = Path(httpd_root) / server_cfg
        paths.add(str(p))

    if sysname.startswith('win'):
        roots = [httpd_root] if httpd_root else []
        roots += [r'C:\\Apache24', r'C:\\Apache2']
        for root in roots:
            if not root:
                continue
            for pat in [
                os.path.join(root, 'conf', 'httpd.conf'),
                os.path.join(root, 'conf', 'extra', '*.conf'),
                os.path.join(root, 'conf', 'vhosts', '*.conf'),
                os.path.join(root, 'conf', '**', '*.conf'),
            ]:
                for f in glob.glob(pat, recursive=True):
                    paths.add(f)
    else:
        pats = [
            '/etc/httpd/conf/httpd.conf',
            '/etc/httpd/conf.d/*.conf',
            '/etc/httpd/conf.modules.d/*.conf',
            '/etc/apache2/apache2.conf',
            '/etc/apache2/httpd.conf',
            '/etc/apache2/conf-enabled/*.conf',
            '/etc/apache2/mods-enabled/*.conf',
            '/etc/apache2/sites-enabled/*.conf',
            '/usr/local/etc/apache2/httpd.conf',
            '/usr/local/etc/apache2/extra/*.conf',
        ]
        for pat in pats:
            for f in glob.glob(pat, recursive=True):
                paths.add(f)

    # Expand include patterns from top-level files where possible.
    final_paths = set()
    to_process = list(paths)
    seen = set()
    include_re = re.compile(r'^\s*Include(?:Optional)?\s+(.+?)\s*$', re.I)

    while to_process:
        p = to_process.pop()
        if p in seen:
            continue
        seen.add(p)
        if os.path.isfile(p):
            final_paths.add(p)
            try:
                with open(p, 'r', encoding='utf-8', errors='ignore') as fh:
                    for line in fh:
                        m = include_re.match(line)
                        if not m:
                            continue
                        inc = m.group(1).strip().strip('"\'')
                        inc = os.path.expandvars(inc)
                        base = os.path.dirname(p)
                        if not os.path.isabs(inc):
                            inc = os.path.join(base, inc)
                        for g in glob.glob(inc, recursive=True):
                            if os.path.isfile(g):
                                to_process.append(g)
            except Exception:
                pass
    return sorted(final_paths)


def read_configs(paths):
    blobs = []
    for p in paths:
        try:
            with open(p, 'r', encoding='utf-8', errors='ignore') as fh:
                blobs.append((p, fh.read()))
        except Exception:
            pass
    return blobs


def has_legacy_addtype_risk(blobs):
    # High-signal but intentionally conservative.
    risky = []
    addtype_re = re.compile(r'^\s*AddType\s+\S+\s+.*\.(php\d*|phtml|phar|cgi|pl|py)(\s|$)', re.I | re.M)
    for p, text in blobs:
        if addtype_re.search(text):
            risky.append(p)
    return risky


def has_windows_rewrite_risk(blobs):
    risky = []
    load_rewrite = False
    for _p, text in blobs:
        if re.search(r'LoadModule\s+rewrite_module', text, re.I):
            load_rewrite = True
            break
    if not load_rewrite:
        return risky
    rewrite_re = re.compile(r'^\s*Rewrite(?:Engine|Rule|Cond)\b', re.I | re.M)
    vhost_re = re.compile(r'<VirtualHost\b', re.I)
    for p, text in blobs:
        if rewrite_re.search(text) and (vhost_re.search(text) or p.lower().endswith('httpd.conf')):
            risky.append(p)
    return risky


def main():
    httpd = find_httpd_binary()
    if not httpd:
        print('UNKNOWN')
        sys.exit(EXIT_UNKNOWN)

    version_out, v_out = get_httpd_info(httpd)
    version = parse_version(version_out + '\n' + v_out)
    if not version:
        print('UNKNOWN')
        sys.exit(EXIT_UNKNOWN)

    # For this plugin context:
    # >= 2.4.62 upstream is patched.
    # 2.4.60 / 2.4.61 need config review.
    # < 2.4.60 may still have other Apache CVEs, but falls outside this specific version gate.
    if version >= (2, 4, 62):
        print('PATCHED')
        sys.exit(EXIT_PATCHED)

    if version < (2, 4, 60):
        print('UNKNOWN')
        sys.exit(EXIT_UNKNOWN)

    configs = gather_config_candidates(v_out)
    blobs = read_configs(configs)
    if not blobs:
        print('UNKNOWN')
        sys.exit(EXIT_UNKNOWN)

    addtype_hits = has_legacy_addtype_risk(blobs)
    if addtype_hits:
        print('VULNERABLE')
        sys.exit(EXIT_VULN)

    if platform.system().lower().startswith('win'):
        rewrite_hits = has_windows_rewrite_risk(blobs)
        if rewrite_hits:
            print('VULNERABLE')
            sys.exit(EXIT_VULN)

    # Vulnerable version but no clear risky config found.
    print('UNKNOWN')
    sys.exit(EXIT_UNKNOWN)


if __name__ == '__main__':
    main()