PHP 5

#!/usr/bin/env bash
# check_cve_2018_10545.sh
# Determine likely exposure to CVE-2018-10545 (PHP-FPM dumpable child processes)
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN

set -u

out_unknown() { echo "UNKNOWN: $1"; exit 2; }
out_vuln()    { echo "VULNERABLE: $1"; exit 1; }
out_patched() { echo "PATCHED: $1"; exit 0; }

have_cmd() { command -v "$1" >/dev/null 2>&1; }

ver_lt() {
  # returns 0 if $1 < $2 using sort -V
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ] && [ "$1" != "$2" ]
}

ver_ge() {
  [ "$1" = "$2" ] && return 0
  ! ver_lt "$1" "$2"
}

phpfpm_bin=""
for c in php-fpm php-fpm5 php-fpm7.0 php-fpm7.1 php-fpm7.2 php-fpm7.3 php-fpm7.4 php-fpm8.0 php-fpm8.1 php-fpm8.2 php-fpm8.3; do
  if have_cmd "$c"; then phpfpm_bin="$c"; break; fi
done

pkg_ver=""
raw_ver=""
if [ -n "$phpfpm_bin" ]; then
  raw_ver="$($phpfpm_bin -v 2>/dev/null | head -n1)"
  pkg_ver="$(printf '%s' "$raw_ver" | sed -n 's/.*PHP \([0-9][0-9.]*\).*/\1/p')"
fi

if [ -z "$pkg_ver" ]; then
  if have_cmd dpkg-query; then
    for p in php5-fpm php-fpm php7.0-fpm php7.1-fpm php7.2-fpm php7.3-fpm php7.4-fpm php8.0-fpm php8.1-fpm php8.2-fpm php8.3-fpm; do
      v="$(dpkg-query -W -f='${Version}' "$p" 2>/dev/null | head -n1)"
      if [ -n "$v" ]; then
        raw_ver="$v"
        pkg_ver="$(printf '%s' "$v" | sed -n 's/^\([0-9][0-9.]*\).*/\1/p')"
        break
      fi
    done
  elif have_cmd rpm; then
    for p in php-fpm php56-php-fpm php70-php-fpm php71-php-fpm php72-php-fpm php73-php-fpm php74-php-fpm php80-php-fpm php81-php-fpm php82-php-fpm php83-php-fpm; do
      v="$(rpm -q --qf '%{VERSION}-%{RELEASE}' "$p" 2>/dev/null)"
      if [ -n "$v" ] && ! printf '%s' "$v" | grep -q 'not installed'; then
        raw_ver="$v"
        pkg_ver="$(printf '%s' "$v" | sed -n 's/^\([0-9][0-9.]*\).*/\1/p')"
        break
      fi
    done
  fi
fi

[ -n "$pkg_ver" ] || out_unknown "php-fpm not found or version could not be determined"

# Determine whether the upstream version falls in a vulnerable window.
upstream_vuln="no"
if ver_ge "$pkg_ver" "5.6.0" && ver_lt "$pkg_ver" "5.6.35"; then upstream_vuln="yes"; fi
if ver_ge "$pkg_ver" "7.0.0" && ver_lt "$pkg_ver" "7.0.29"; then upstream_vuln="yes"; fi
if ver_ge "$pkg_ver" "7.1.0" && ver_lt "$pkg_ver" "7.1.16"; then upstream_vuln="yes"; fi
if ver_ge "$pkg_ver" "7.2.0" && ver_lt "$pkg_ver" "7.2.4"; then upstream_vuln="yes"; fi

# If version is outside affected windows, call it patched.
if [ "$upstream_vuln" = "no" ]; then
  out_patched "Detected PHP-FPM version $pkg_ver is outside upstream vulnerable ranges"
fi

# Look for FPM pool configs and count distinct users.
conf_dirs="/etc/php-fpm.d /etc/php*/fpm/pool.d /usr/local/etc/php-fpm.d"
users=""
for d in $conf_dirs; do
  [ -d "$d" ] || continue
  while IFS= read -r -d '' f; do
    u="$(grep -E '^[[:space:]]*user[[:space:]]*=' "$f" 2>/dev/null | tail -n1 | sed 's/.*=//; s/[[:space:]]//g')"
    [ -n "$u" ] && users="$users
$u"
  done < <(find "$d" -maxdepth 1 -type f \( -name '*.conf' -o -name '*.pool' \) -print0 2>/dev/null)
done

distinct_users="$(printf '%s
' "$users" | sed '/^$/d' | sort -u | wc -l | tr -d ' ')"

# Heuristic: vulnerable upstream version + multiple pool users => likely exposed.
# Single-user deployments are often not meaningfully exposed to the cross-tenant angle.
if [ "$distinct_users" -ge 2 ]; then
  out_vuln "Upstream vulnerable PHP-FPM version $pkg_ver with multiple distinct pool users detected ($distinct_users users); check for distro backports before patching"
fi

# Backport caveat for distro builds.
if printf '%s' "$raw_ver" | grep -Eq 'deb|ubuntu|el[0-9]|fc[0-9]|suse'; then
  out_unknown "Version string '$raw_ver' may include distro backports; upstream version looks vulnerable, but package maintenance could already include the fix"
fi

out_unknown "Upstream vulnerable PHP-FPM version $pkg_ver detected, but host does not clearly appear multi-tenant; verify package backports and pool topology manually"