Missing HTTP Strict Transport Security (HSTS) Policy — Tenable WAS Plugin 98056

#!/usr/bin/env bash
# check_hsts.sh — Verify Strict-Transport-Security header on a target URL
# Usage: ./check_hsts.sh https://target.example.com
# Exit: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN

set -u
TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "UNKNOWN: usage: $0 https://host" >&2
  exit 2
fi

if ! command -v curl >/dev/null 2>&1; then
  echo "UNKNOWN: curl not installed" >&2
  exit 2
fi

# Grab response headers, follow redirects (server may redirect http->https)
HEADERS=$(curl -sSIL --max-time 10 "$TARGET" 2>/dev/null) || {
  echo "UNKNOWN: could not fetch $TARGET"
  exit 2
}

# Look for Strict-Transport-Security (case-insensitive) on the FINAL response
HSTS_LINE=$(printf '%s\n' "$HEADERS" | awk 'BEGIN{IGNORECASE=1} /^strict-transport-security:/ {print; found=1} END{exit !found}')
RC=$?

if [[ $RC -ne 0 || -z "$HSTS_LINE" ]]; then
  echo "VULNERABLE: no Strict-Transport-Security header on $TARGET"
  exit 1
fi

# Parse max-age
MAX_AGE=$(printf '%s' "$HSTS_LINE" | grep -oiE 'max-age=[0-9]+' | head -1 | cut -d= -f2)
if [[ -z "${MAX_AGE:-}" ]]; then
  echo "VULNERABLE: HSTS header present but no max-age directive: $HSTS_LINE"
  exit 1
fi

if (( MAX_AGE < 31536000 )); then
  echo "VULNERABLE: HSTS max-age=$MAX_AGE is below 1 year (31536000). Header: $HSTS_LINE"
  exit 1
fi

if ! printf '%s' "$HSTS_LINE" | grep -qi 'includeSubDomains'; then
  echo "VULNERABLE: HSTS present but missing includeSubDomains. Header: $HSTS_LINE"
  exit 1
fi

echo "PATCHED: $HSTS_LINE"
exit 0