Microsoft ASP

# check-cve-2007-2897.ps1

# Best-effort verifier for CVE-2007-2897 / Nessus 64588

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'Stop'

function Out-Result {
    param(
        [string]$State,
        [string]$Reason,
        [int]$Code
    )
    Write-Output "$State - $Reason"
    exit $Code
}

try {
    $iisReg = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\InetStp' -ErrorAction Stop
} catch {
    Out-Result -State 'PATCHED' -Reason 'IIS is not installed on this host' -Code 0
}

$major = $null
if ($iisReg.PSObject.Properties.Name -contains 'MajorVersion') {
    $major = [int]$iisReg.MajorVersion
} elseif ($iisReg.PSObject.Properties.Name -contains 'VersionString') {
    if ($iisReg.VersionString -match '([0-9]+)') { $major = [int]$Matches[1] }
}

if ($null -eq $major) {
    Out-Result -State 'UNKNOWN' -Reason 'Could not determine IIS version' -Code 2
}

if ($major -ne 6) {
    Out-Result -State 'PATCHED' -Reason "IIS major version is $major, not IIS 6.0" -Code 0
}

$asp11Path = Join-Path $env:WINDIR 'Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll'
if (-not (Test-Path $asp11Path)) {
    Out-Result -State 'PATCHED' -Reason 'ASP.NET 1.1 is not installed' -Code 0
}

# Optional OS context: IIS 6.0 usually implies Windows Server 2003 era.

$os = Get-CimInstance Win32_OperatingSystem
$osVersion = $os.Version

# Try to determine whether ASP.NET 1.1 is actually enabled in IIS 6.0 web service extensions.

$adsutil = Join-Path $env:SystemDrive 'Inetpub\AdminScripts\adsutil.vbs'
if (-not (Test-Path $adsutil)) {
    Out-Result -State 'UNKNOWN' -Reason 'IIS 6.0 detected and ASP.NET 1.1 present, but AdminScripts/adsutil.vbs is missing so enablement could not be verified' -Code 2
}

try {
    $raw = & cscript.exe //NoLogo $adsutil GET W3SVC/WebSvcExtRestrictionList 2>$null
    $text = ($raw | Out-String)
} catch {
    Out-Result -State 'UNKNOWN' -Reason 'Failed to query IIS 6.0 Web Service Extensions' -Code 2
}

# Heuristics for legacy IIS 6 output:

# Allowed entries often contain ASP.NET v1.1.4322 or the aspnet_isapi.dll path with an enabled/allowed marker.

$mentionsAsp11 = $text -match 'v1\.1\.4322|aspnet_isapi\.dll'
$blockedAsp11 = $text -match 'Prohibited.*v1\.1\.4322|0,.*v1\.1\.4322|0,.*aspnet_isapi\.dll'
$allowedAsp11 = $text -match 'Allowed.*v1\.1\.4322|1,.*v1\.1\.4322|1,.*aspnet_isapi\.dll'

if (-not $mentionsAsp11) {
    Out-Result -State 'PATCHED' -Reason 'ASP.NET 1.1 files exist, but IIS 6.0 does not appear to have the ASP.NET 1.1 extension enabled' -Code 0
}

if ($blockedAsp11 -and -not $allowedAsp11) {
    Out-Result -State 'PATCHED' -Reason 'ASP.NET 1.1 appears installed but prohibited in IIS 6.0 Web Service Extensions' -Code 0
}

if ($allowedAsp11) {
    Out-Result -State 'VULNERABLE' -Reason "IIS 6.0 with ASP.NET 1.1 enabled detected (OS version $osVersion); this matches the narrow exposure profile for CVE-2007-2897" -Code 1
}

Out-Result -State 'UNKNOWN' -Reason 'IIS 6.0 and ASP.NET 1.1 are present, but extension state could not be confidently classified' -Code 2