cvecheck

#!/usr/local/cpanel/3rdparty/bin/perl

use strict;

my $vers="1.0.29";

use Cpanel::SafeRun::Timed();
use JSON::PP;
use Cpanel::OS();
use Getopt::Long;
use Term::ANSIColor qw(:constants);
use LWP::UserAgent;
$Term::ANSIColor::AUTORESET = 1;
use Text::Tabs;
$tabstop = 4;
use File::Temp;
my $gl_is_kernel=0;
my $distro       = Cpanel::OS->_instance->distro;
my $distro_major = Cpanel::OS->_instance->major;
my $distro_minor = Cpanel::OS->_instance->minor;
my $distro_version = $distro_major . "." . $distro_minor;
my $debug=0;
my $verbose=0;
my $remote;
my $package;
my $pkgtocheck;
my $cveid;
my $cvetocheck;
my $help;
my $list;
my $OPT_TIMEOUT;


my $pkg_list;
if ( $distro eq 'ubuntu' ) {
    open( STDERR, '>', '/dev/null' ) if ( ! $debug );
    $pkg_list = Cpanel::SafeRun::Timed::timedsaferun( 0, 'dpkg-query', '-W', '-f${binary:Package}\n' );
    close( STDERR ) if ( ! $debug );
}
else {
    open( STDERR, '>', '/dev/null' ) if ( ! $debug );
    $pkg_list = Cpanel::SafeRun::Timed::timedsaferun( 0, 'rpm', '-qa', '--queryformat', '%{Name}\n' );
    close( STDERR ) if ( ! $debug );
}
my @pkg_list = split /\n/, $pkg_list;

GetOptions(
    'debug'       => \$debug,
    'verbose'     => \$verbose,
    'package=s'   => \$package,
    'cveid=s'     => \$cveid,
    'help'        => \$help,
    'list'        => \$list,
    'remote'      => \$remote,
);

print MAGENTA "Distro: " . CYAN $distro . " [ $distro_version ]\n" if ( $debug || $verbose );

# Default is to use a local cve_data.txt file where cvecheck is used. If this file doesn't exist one will be downloaded
# from a remote location into /tmp with a random filename cve_data_XXXXX.json

if ( $help ) {
    print CYAN "Default is to use a local copy of cve_data.json in the same directory as cvecheck.\n";
    print CYAN "If this file doesn't exist, then an attempt is made to download it from the CSI git repo.\n";
    print CYAN "You can pass the following options:\n\n";
    print YELLOW "--help - what you see here!\n";
    print YELLOW "--list - List the data within the cve_data.json file.\n";
    print YELLOW "--verbose - Shows output of every thing checked. [ default is to be quiet ]\n";
    print YELLOW "--debug - Show debug output of every thing checked. [ default is to be quiet ] --debug output may show errors.\n";
    print YELLOW "--remote - If local cve_data.json file exists, it will use that otherwise it will download the current one.\n";
    print YELLOW "--package=packagename - Check only this package against our cve_data.json file.\n";
    print YELLOW "--cveid=CVE-XXXX-XXXXX - Check only this CVE ID against our cve_data.json file.\n";
    print GREEN "\nIf nothing is returned when you run cvecheck, then your server should be patched and not vulnerable..\n\n";
    print GREEN "The steps performed  are: \n";
    print GREEN "\t1) Is the package installed? (boolean true or false). If false, continue with next package.\n";
    print GREEN "\t2) If true, then check if it's a kernel or linux-header package (boolean true or false).\n";
    print GREEN "\tkernel/linux-header packages require a name change to the package name.\n\n";
    print GREEN "\t3) Check if the CVE ID from the known exploit is listed in the packages changelog (boolean true or false).\n";
    print GREEN "\t4) If so, move on to the next package. If not, check the version of the installed package and see if it\n";
    print GREEN "\tis greater than to the patched version.\n";
    print GREEN "\t5) If so, move on to the next package. If not, check the version of the installed package and see if it\n";
    print GREEN "\tis less than to the patched version.\n";
    print GREEN "\t6) If so, then not vulnerable.  If not, then list it as possibly being vulnerable.\n";
    print "\n";
    exit;
}


my $file_option = ( $remote ) ? 'remote' : 'local';
my $cvedata_filename='cve_data.json';

if ( ! $remote ) {
    if ( -s 'cve_data.json' ) {
        print CYAN "Local $cvedata_filename file exists.\n" if ( $debug || $verbose );
        print BOLD YELLOW "Opening local $cvedata_filename file\n" if ( $debug || $verbose );
    }
    else {
        print CYAN "Local $cvedata_filename file does not exist. Attempting remote...\n" if ( $debug || $verbose );
        print CYAN "Downloading $cvedata_filename ...\n" if ( $debug || $verbose );
        $file_option='remote';
    }
}

sub get_temp_filename {
    my $fh = File::Temp->new(
        TEMPLATE => 'cve_data_XXXXX',
        DIR      => '/tmp',
        SUFFIX   => '.json',
    );
    return $fh->filename;
}

if ( $file_option eq 'remote' || $remote ) {
    $cvedata_filename = get_temp_filename();
    print BOLD YELLOW "Downloading $cvedata_filename file from remote location\n" if ( $debug || $verbose );
    my $url = URI->new( 'https://raw.githubusercontent.com/CpanelInc/tech-CSI/master/cve_data.json');
    my $ua;
    my $res;
    my $CVEDATA;
    my @CVEDATA;
    $ua  = LWP::UserAgent->new( ssl_opts => { verify_hostname => 0 } );
    $res = $ua->get($url);
    $CVEDATA  = $res->decoded_content;
    @CVEDATA  = split /\n/, $CVEDATA;
    open( my $fh, '>', $cvedata_filename );
    foreach my $line(@CVEDATA) {
        chomp($line);
        print $fh $line . "\n";
    }
    close( $fh );
}

my $data;
if ( open ( my $json_stream, $cvedata_filename ) ) {
    local $/ = undef;
    my $json = JSON::PP->new;
    $data = $json->decode(<$json_stream>);
    close($json_stream);
}

if ( $list ) {
    print MAGENTA "The cve_data.json file contains the following data...\n";
    foreach my $line( @{ $data } ) {
        print BOLD WHITE "============================== [ " . YELLOW $line->{Package_Name} . BOLD WHITE " ] ====================================\n";
        print CYAN "CVE-ID: " . YELLOW $line->{CVE_ID} . "\n";
        print CYAN "Vulnerable in which OS: " . YELLOW $line->{OS_Vulnerable} . "\n";
        print CYAN "Version less than: " . YELLOW $line->{First_Vulnerable_Version} . " is NOT vulnerable\n";
        print CYAN "Version greater than: " . YELLOW $line->{Patched_Version} . " is NOT vulnerable\n";
        print CYAN "Link for addtional info: " . YELLOW $line->{Link} . "\n" unless( $line->{Link} eq "" );;
    }
    print "\n";
    exit;
}

if ( $package ) {
    $pkgtocheck = $package;
}

if ( $cveid ) {
    $cvetocheck = $cveid;
}

my $show=0;

foreach my $line( @{ $data } ) {
    my $pkg = $line->{Package_Name};
    my $cve = $line->{CVE_ID};
    my $patchedver = $line->{Patched_Version};
    my $firstvuln = $line->{First_Vulnerable_Version};
    my $os_vuln = $line->{OS_Vulnerable};
    if ( $package ) {
        next unless( $pkg eq $pkgtocheck );
        print MAGENTA "Checking only for " . BOLD YELLOW $pkgtocheck . "\n" if ( $debug && $show == 0 || $verbose && $show == 0 );
        $show=1;
    }
    if ( $cveid ) {
        next unless( $cve =~ m/$cvetocheck/ );
        print MAGENTA "Checking only for " . BOLD YELLOW $cvetocheck . "\n" if ( $debug && $show == 0 || $verbose && $show == 0 );
        $show=1;
    }
    if ( is_os_vulnerable( $os_vuln ) == 0 ) {
        next;
    }
    print BOLD WHITE "==================== [ " . YELLOW $pkg . " / " . $cve . BOLD WHITE " ] ====================\n" if ( $debug || $verbose );
    # Check if package is installed
    print CYAN "Checking if " . YELLOW $pkg . " is installed: " if ( $debug || $verbose );
    my $installed = is_installed( $pkg );
    my $is_installed = ( $installed ) ? "Yes" : "No";
    print GREEN $is_installed . "\n" if ( $debug || $verbose );
    next unless( $installed );

    # Check if package is kernel or linux-headers (if so, uname -r must be added)
    print CYAN "Checking if " . YELLOW $pkg . " is a kernel/linux-header package: " if ( $debug || $verbose );
    my $pkg1 = is_kernel( $pkg );        ## Checks to see if $pkg is a kernel or linux-headers pacakge!
    my $is_kernel = ( $pkg1 =~ m{kernel|linux-header} ) ? "Yes" : "No";
    print GREEN $is_kernel . "\n" if ( $debug || $verbose );
    $pkg=$pkg1;
    # If we get here, it is installed, now get the version number
    print CYAN "Getting version number of " . YELLOW $pkg . ": " if ( $debug || $verbose );
    chomp( my $pkgver = get_pkg_version( $pkg ) );
    my $digitpkgver;
    my $alphapkgver;
    $digitpkgver = digit_to_alpha( $pkgver ) // '' if ( $pkg =~ m{openssl} && $pkgver < 3);
    chomp( $pkgver );
    if ( $pkgver eq "" ) {
        print RED "\n\t\\_ WARNING! - Version undefined/missing for $pkg\n";
        print MAGENTA "\t\\_ THIS SHOULD NOT BE POSSIBLE IF THE PACKAGE IS PROPERLY INSTALLED! - Exiting.\n";
        exit;
    }
    else {
        if ( $pkg =~ m{openssl} ) {
            if ( $pkgver < 3 ) {
                print GREEN $pkgver . " (Converted to: " . $digitpkgver . " )\n" if ( $debug || $verbose );
            }
            else {
                print GREEN $pkgver . "\n" if ( $debug || $verbose );
            }
        }
        else {
            print GREEN $pkgver . "\n" if ( $debug || $verbose );
        }
    }

    # report first vulnerable version (if verbose or debug is enabled)
    $alphapkgver = alpha_to_digit( $firstvuln ) // '' if ( $pkg =~ m{openssl} && $pkgver < 3);
    if ( $pkg =~ m{openssl} and $pkgver < 3) {
        print CYAN "First vulnerable reported version: " . GREEN $alphapkgver . " (Converted to: " . $firstvuln . " )\n" if ( $debug || $verbose );
    }
    else {
        print CYAN "First vulnerable reported version: " . GREEN $firstvuln . "\n" if ( $debug || $verbose );
    }

    # check changelog for the CVE
    print CYAN "Checking to see if " . BOLD RED $cve . CYAN " for " . YELLOW $pkg . CYAN " is in the changelogs: " if ( $debug || $verbose );
    my $found_in_changelog = found_in_changelog( $pkg, $cve );
    my $in_changelog = ( $found_in_changelog ) ? "Yes - Patched" : "No " . WHITE "- Checking version numbers...";
    print GREEN $in_changelog . "\n" if ( $debug || $verbose );
    next unless( ! $found_in_changelog );

    # check to see if version is greater than or equal to the patchedver variable
    my $op1='>';
    chomp($patchedver);
    if ( $pkg =~ m{openssl} && $pkgver < 3) {
        print CYAN "Checking if " . YELLOW $digitpkgver . " is " . MAGENTA $op1 . " " . YELLOW $patchedver . ": " if ( $debug || $verbose );
    }
    else {
        print CYAN "Checking if " . YELLOW $pkgver . " is " . MAGENTA $op1 . " " . YELLOW $patchedver . ": " if ( $debug || $verbose );
    }
    my $vercmp = ( version_compare( $pkgver, $op1, $patchedver ) ) ? "Yes - Patched" : "No";
    print GREEN $vercmp . "\n" if ( $debug || $verbose );
    next if ( version_compare( $pkgver, $op1, $patchedver ) );

    # check to see if version is less than the firstvuln variable
    my $op2='>';
    chomp($firstvuln);
    if ( $pkg =~ m{openssl} && $pkgver < 3) {
        print CYAN "Checking if " . YELLOW $digitpkgver . " is " . MAGENTA $op2 . CYAN " the first vulnerable reported version of: " . YELLOW $firstvuln . ": " if ( $debug || $verbose );
    }
    else {
        print CYAN "Checking if " . YELLOW $pkgver . " is " . MAGENTA $op2 . CYAN " the first vulnerable reported version of: " . YELLOW $firstvuln . ": " if ( $debug || $verbose );
    }
    my $vercmp = ( version_compare( $pkgver, $op2, $firstvuln ) ) ? "Yes - Patched" : "No";
    print GREEN $vercmp . "\n" if ( $debug || $verbose );
    next if ( version_compare( $pkgver, $op2, $firstvuln ) );

    print CYAN "\tVersion " . YELLOW $pkgver . CYAN " of the " . GREEN $pkg . CYAN " package is " . RED "Vulnerable " . CYAN "to " . YELLOW $cve . "\n";
    if ( $pkgver eq $patchedver ) {
        print YELLOW "\t\t\\_ Running version matches patched version - Might be patched via backporting - But nothing was found in the changelog!\n";
    }
    # Add check here for imunify360-ea-php-hardened (which is always behind).
    if ( $distro ne 'ubuntu' ) {
        my $pkginfo=Cpanel::SafeRun::Timed::timedsaferun( 0, 'dnf', 'info', $pkg );
        my @pkginfo = split '\n', $pkginfo;
        foreach my $infoline(@pkginfo) {
            if ( $infoline =~ m{imunify360-ea-php-hardened} ) {
                print MAGENTA "\t\t\\_ Note: $pkg is installed from the " . YELLOW "imunify360-ea-php-hardened" . MAGENTA " repo and may be behind on updates!\n";
                last;
            }
        }
    }
}

if ( $file_option eq 'remote' ) {
    unlink( $cvedata_filename) if ( -f $cvedata_filename );
}
print "\n";
exit;

sub digit_to_alpha {
    my $tcPkgVer = shift;
    return unless ( $tcPkgVer =~ /(\d+)\.(\d+)\.(\d+)([a-z])([a-z]?)/ );
    my $retPkgVer;
    my ( $maj, $min, $patch ) = ( $1, $2, $3 );
    # If we map the alphas into a number and sum the values the version will be compatible with version_compare()
    # and save us a lot of trouble, i.e. h=8, m=13, and za=27
    my %al2num = map { ( "a" .. "z" )[ $_ - 1 ] => $_ } ( 1 .. 26 );
    my $sub = 0;
    if ($4) { $sub += $al2num{ lc($4) } }
    if ($5) { $sub += $al2num{ lc($5) } }
    $retPkgVer = join( '.', $maj, $min, $patch, $sub );
    return $retPkgVer;
}

sub alpha_to_digit {
    my $tcPkgVer = shift;
    my @letters = ( "a" .. "z" );
    my $retPkgVer;
    my ( $maj, $min, $patch, $sub ) = ( split( /\./, $tcPkgVer ) );
    my $sub1 = $letters[ $sub - 1 ];
    $retPkgVer = join( '.', $maj, $min, $patch );
    $retPkgVer .= $sub1;
}

sub is_os_vulnerable {
    my $tcOSData = shift;
    my @tcOSData = split /\s+/, $tcOSData;
    my $os_vulnerable=0;
    if ( $tcOSData eq 'ALL' ) {
        return 1;
    }
    foreach my $tcOSLine(@tcOSData) {
        chomp($tcOSLine);
        my ( $tcOSDist,$tcOSVer ) = (split( /\-/, $tcOSLine ));
        chomp( $tcOSDist);
        chomp( $tcOSVer);
        my $op='>=';
        if ( $distro eq $tcOSDist ) {
            if ( version_compare( $distro_version, $op, $tcOSVer) ) {
                $os_vulnerable=1;
                last;
            }
        }
    }
    return $os_vulnerable;
}

sub is_kernel {
    my $tcPkg = shift;
    $gl_is_kernel=0;
    if ( $tcPkg =~ m{kernel|linux-headers} ) {
        open( STDERR, '>', '/dev/null' ) if ( ! $debug );
        my $uname = Cpanel::SafeRun::Timed::timedsaferun( 0, 'uname', '-r' );
        close( STDERR ) if ( ! $debug );
        chomp($uname);
        if ( $distro eq 'ubuntu' ) {
            $tcPkg="linux-headers-$uname";
        }
        else {
            $tcPkg="kernel-$uname";
        }
        $gl_is_kernel=1;
    }
    return $tcPkg;
}

sub found_in_changelog {
    my $tcPkg = shift;
    my $tcCVE = shift;
    my $in_chglog=0;
    my $in_chglog1=0;
    if ($distro eq "ubuntu" ) {
        if ( ! -f "/usr/share/doc/$tcPkg/changelog.Debian.gz" ) {
            print RED "\n\t\\_ WARNING! - /usr/share/doc/$tcPkg/changelog.Debian.gz IS MISSING!!! - ";
            $in_chglog1=0;
        }
        else {
            open( STDERR, '>', '/dev/null' ) if ( ! $debug );
            $in_chglog1 = ( Cpanel::SafeRun::Timed::timedsaferun( 0, 'zgrep', '-E', "$tcCVE", "/usr/share/doc/$tcPkg/changelog.Debian.gz" ) ) ? 1 : 0;
            close( STDERR ) if ( ! $debug );
            $in_chglog=1 unless( $in_chglog1 == 0 );
        }
    }
    else {
        open( STDERR, '>', '/dev/null' ) if ( ! $debug );
        $in_chglog1 = Cpanel::SafeRun::Timed::timedsaferun( 0, 'rpm', '-q', "$tcPkg", '--changelog' );
        close( STDERR ) if ( ! $debug );
        $in_chglog = ( grep { /$tcCVE/ } $in_chglog1 ) ? 1 : 0;
    }
    # If not found in changelog via regular methods - See if KernelCare is installed and check using --patch-info
    if ( $in_chglog == 0 && $gl_is_kernel == 1 ) {
        return $in_chglog unless( -x '/usr/bin/kcarectl' );
        print BOLD GREEN "\n\t\\_ Not found via regular changelog, KernelCare detected - Checking with --patch-info: " if ( $verbose || $debug );
        open( STDERR, '>', '/dev/null' ) if ( ! $debug );
        my $patchinfo = Cpanel::SafeRun::Timed::timedsaferun(3, 'kcarectl', '--patch-info' );
        close( STDERR ) if ( ! $debug );
        my @patchinfo = split /\n/, $patchinfo;
        my $in_chglog = ( grep { /$tcCVE/ } @patchinfo ) ? 1 : 0;
        return $in_chglog;
    }
    return $in_chglog;
}

sub is_installed {
    my $tcPkg = shift;
    my $is_installed=0;
    foreach my $package(@pkg_list) {
        chomp($package);
        if ( $tcPkg eq $package ) {
            $is_installed=1;
            last;
        }
    }
    return $is_installed;
}

sub get_pkg_version {
    my $tcPkg = shift;
    my $pkgversion;
    if ( $distro eq 'ubuntu' ) {
        open( STDERR, '>', '/dev/null' ) if ( ! $debug );
        $pkgversion=Cpanel::SafeRun::Timed::timedsaferun( 0, 'dpkg-query', '-W', '-f=${Version}\n', "$tcPkg" );
        close( STDERR ) if ( ! $debug );
    }
    else {
        open( STDERR, '>', '/dev/null' ) if ( ! $debug );
        $pkgversion=Cpanel::SafeRun::Timed::timedsaferun( 0, 'rpm', '-q', '--queryformat', '%{Version}-%{Release}', "$tcPkg" );
        close( STDERR ) if ( ! $debug );
    }
    if ( $gl_is_kernel == 0 ) {
        $pkgversion =~ s/$tcPkg//g;
    }
    chomp($pkgversion);
    $pkgversion =~ s/$tcPkg//g;
    $pkgversion =~ s/^\.\.//;
    $pkgversion =~ s/^\-\-//;
    $pkgversion =~ s/\-/\./g;
    $pkgversion =~ s/(\.x86_64|\.cpanel|\.cloudlinux|p2.*|\.deb.*|\.noarch|.1ubuntu.*|ubuntu.*|\.cp\d+.*|\.el.*|\+.*)//g;

    return $pkgversion;
}

sub version_compare {
    # example: return if version_compare($ver_string, qw( >= 1.2.3.3 ));
    # Must be no more than four version numbers separated by periods and/or underscores.
    my ( $ver1, $mode, $ver2 ) = @_;
    return if ( !defined($ver1) || ( $ver1 =~ /[^\._0-9]/ ) );
    return if ( !defined($ver2) || ( $ver2 =~ /[^\._0-9]/ ) );

    my %modes = (
        '>' => sub {
            return if $_[0] eq $_[1];
            return _version_cmp(@_) > 0;
        },
        '<' => sub {
            return if $_[0] eq $_[1];
            return _version_cmp(@_) < 0;
        },
        '==' => sub { return $_[0] eq $_[1] || _version_cmp(@_) == 0; },
        '!=' => sub { return $_[0] ne $_[1] && _version_cmp(@_) != 0; },
        '>=' => sub {
            return 1 if $_[0] eq $_[1];
            return _version_cmp(@_) >= 0;
        },
        '<=' => sub {
            return 1 if $_[0] eq $_[1];
            return _version_cmp(@_) <= 0;
        }
    );
    return if ( !exists $modes{$mode} );
    return $modes{$mode}->( $ver1, $ver2 );
}

sub _version_cmp {
    my ( $first, $second ) = @_;
    my ( $a1,    $b1, $c1, $d1, $e1, $f1 ) = split /[\._]/, $first;
    my ( $a2,    $b2, $c2, $d2, $e2, $f2 ) = split /[\._]/, $second;
    for my $ref ( \$a1, \$b1, \$c1, \$d1, \$e1, \$f1, \$a2, \$b2, \$c2, \$d2, \$e2, \$f2,) {    # Fill empties with 0
        $$ref = 0 unless defined $$ref;
    }
    return $a1 <=> $a2 || $b1 <=> $b2 || $c1 <=> $c2 || $d1 <=> $d2 || $e1 <=> $e2 || $f1 <=> $f2;
}