@pbpyrojust/universal-security-audit 0.0.0-stage → 0.3.0

package/scripts/lib/wordfence.mjs

@@ -0,0 +1,112 @@
+// ── Wordfence Intelligence: known WordPress core/plugin/theme vulnerabilities ──
+// Free for commercial use with attribution; each user brings their own API key (wordfence.com →
+// Integrations). The feed is one ~160 MB JSON object, and the key's download limit is small and
+// unpublished, so it's fetched at most once a day and kept as a compact index (slug → ranges) in
+// the user's cache folder; later runs read only the index. Only used for sites detected as
+// WordPress, and only when a key is given.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const FEED = 'https://www.wordfence.com/api/intelligence/v3/vulnerabilities/production';
+const MAX_AGE_MS = 24 * 3600_000;
+
+export const WORDFENCE_ATTRIBUTION = 'Vulnerability data: Wordfence Intelligence (https://www.wordfence.com/threat-intel/). Copyright Defiant Inc., used under the Wordfence Intelligence license (https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/).';
+
+function cacheFile() {
+  const base = process.env.XDG_CACHE_HOME || path.join(os.homedir(), '.cache');
+  return path.join(base, 'universal-security-audit', 'wordfence-index.json');
+}
+
+/** -1, 0 or 1, comparing dotted versions number by number ("6.10.2" > "6.9.10"). */
+export function compareVersions(a, b) {
+  const pa = String(a).split(/[.\-+]/).map((n) => parseInt(n, 10) || 0);
+  const pb = String(b).split(/[.\-+]/).map((n) => parseInt(n, 10) || 0);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+    if (d) return d < 0 ? -1 : 1;
+  }
+  return 0;
+}
+
+export function isAffected(version, ranges) {
+  return ranges.some((r) => {
+    const above = r.from === '*' || (r.fi ? compareVersions(version, r.from) >= 0 : compareVersions(version, r.from) > 0);
+    const below = r.to === '*' || (r.ti ? compareVersions(version, r.to) <= 0 : compareVersions(version, r.to) < 0);
+    return above && below;
+  });
+}
+
+/** Feed records → { "plugin:slug": [{ id, title, cve, rating, score, ranges, patched, url }] }. Exported for tests. */
+export function buildIndex(feed) {
+  const index = {};
+  for (const [id, v] of Object.entries(feed)) {
+    if (v.informational) continue;
+    for (const s of v.software ?? []) {
+      const kind = ['core', 'plugin', 'theme'].includes(s.type) ? s.type : null;
+      const slug = kind === 'core' ? 'wordpress' : String(s.slug ?? '').toLowerCase();
+      if (!kind || !slug) continue;
+      const ranges = Object.values(s.affected_versions ?? {}).map((r) => ({ from: String(r.from_version ?? '*'), fi: r.from_inclusive !== false, to: String(r.to_version ?? '*'), ti: r.to_inclusive !== false }));
+      if (!ranges.length) continue;
+      const key = `${kind}:${slug}`;
+      const list = (index[key] ??= []);
+      const same = list.find((x) => x.id === id);
+      if (same) {
+        // Core vulnerabilities list WordPress once per release branch.
+        same.ranges.push(...ranges);
+        same.patched = [...new Set([...same.patched, ...(s.patched_versions ?? []).map(String)])];
+        continue;
+      }
+      list.push({
+        id,
+        title: String(v.title ?? ''),
+        cve: v.cve ?? null,
+        rating: v.cvss?.rating ? String(v.cvss.rating).toLowerCase() : null,
+        score: v.cvss?.score ?? null,
+        ranges,
+        patched: (s.patched_versions ?? []).map(String),
+        url: (v.references ?? []).find((u) => /wordfence\.com/.test(u)) ?? `https://www.wordfence.com/threat-intel/vulnerabilities/id/${id}`,
+      });
+    }
+  }
+  return index;
+}
+
+/** The cached index, refreshed when older than a day. Returns { index, error }. */
+export async function loadIndex(apiKey, { file = cacheFile(), now = Date.now() } = {}) {
+  let cached = null;
+  try {
+    const stat = fs.statSync(file);
+    cached = { index: JSON.parse(fs.readFileSync(file, 'utf8')), fresh: now - stat.mtimeMs < MAX_AGE_MS };
+  } catch {}
+  if (cached?.fresh) return { index: cached.index, error: null };
+  try {
+    const res = await fetch(FEED, { headers: { Authorization: `Bearer ${apiKey}` }, signal: AbortSignal.timeout(300_000) });
+    if (!res.ok) {
+      const why = res.status === 401 ? 'Wordfence refused the API key (check WORDFENCE_API_KEY)' : res.status === 429 ? 'the Wordfence key\'s download limit was reached; try again in a few hours' : `Wordfence answered HTTP ${res.status}`;
+      // An older copy is better than nothing.
+      return cached ? { index: cached.index, error: `${why}; used the copy from ${new Date(fs.statSync(file).mtimeMs).toISOString().slice(0, 10)}` } : { index: null, error: why };
+    }
+    const index = buildIndex(await res.json());
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(index));
+    return { index, error: null };
+  } catch (e) {
+    return cached ? { index: cached.index, error: `couldn't refresh the Wordfence feed (${e?.message || e}); used the cached copy` } : { index: null, error: `couldn't download the Wordfence feed (${e?.message || e})` };
+  }
+}
+
+/** Vulnerabilities affecting one component at this exact version, each with the first fixed version above it. */
+export function lookup(index, kind, slug, version) {
+  if (!index || !version) return [];
+  return (index[`${kind}:${String(slug).toLowerCase()}`] ?? [])
+    .filter((v) => isAffected(version, v.ranges))
+    .map((v) => ({ ...v, fixedIn: v.patched.filter((p) => compareVersions(p, version) > 0).sort(compareVersions)[0] ?? null }));
+}
+
+/** Finding severity from Wordfence's rating, or the CVSS score. */
+export function severityOf(v) {
+  if (['critical', 'high', 'medium', 'low'].includes(v.rating)) return v.rating;
+  const s = Number(v.score);
+  return s >= 9 ? 'critical' : s >= 7 ? 'high' : s >= 4 ? 'medium' : 'low';
+}

package/scripts/lib/wp-admin-audit.mjs

@@ -0,0 +1,102 @@
+// ── Authenticated WordPress wp-admin audit. Requires the caller to already be logged in
+// (via maybePerformFormLogin against /wp-login.php). Every function here just navigates to a
+// standard wp-admin screen the logged-in user already has access to and reads the rendered DOM —
+// no privilege escalation, no writes, nothing the user couldn't see by clicking around themselves. ──
+
+const KNOWN_SECURITY_PLUGIN_SLUGS = [
+  'wordfence', 'better-wp-security', 'sucuri-scanner', 'all-in-one-wp-security-and-firewall',
+  'wp-fail2ban', 'wp-simple-firewall', 'bulletproof-security', 'wp-cerber', 'wp-simple-firewall-pro',
+  'ithemes-security-pro', 'malcare-security', 'shield-security', 'limit-login-attempts-reloaded',
+  'two-factor', 'wp-2fa', 'defender-security',
+];
+
+export async function isLoggedIntoWpAdmin(page, origin) {
+  try {
+    const res = await page.goto(new URL('/wp-admin/', origin).toString(), { waitUntil: 'domcontentloaded', timeout: 30000 });
+    const url = page.url();
+    return !/wp-login\.php/i.test(url) && (res?.status?.() ?? 200) < 400;
+  } catch { return false; }
+}
+
+export async function scanWpPlugins(page, origin) {
+  try {
+    await page.goto(new URL('/wp-admin/plugins.php', origin).toString(), { waitUntil: 'domcontentloaded', timeout: 30000 });
+    return await page.$$eval('tr[data-slug]', (rows) => rows.map((row) => {
+      const slug = row.getAttribute('data-slug') || '';
+      const isActive = row.className.includes('active') && !row.className.includes('inactive');
+      const nameEl = row.querySelector('.plugin-title strong');
+      const name = nameEl ? nameEl.textContent.trim() : slug;
+      const descText = row.querySelector('.plugin-version-author-uri')?.textContent || row.textContent || '';
+      const verMatch = /Version\s+([\d.]+)/i.exec(descText);
+      const updateRow = row.nextElementSibling;
+      const updateAvailable = !!(updateRow && updateRow.className.includes('update'));
+      let updateToVersion = null;
+      if (updateAvailable) {
+        const m = /view version\s+([\d.]+)/i.exec(updateRow.textContent || '');
+        updateToVersion = m ? m[1] : null;
+      }
+      return { slug, name, active: isActive, version: verMatch ? verMatch[1] : null, updateAvailable, updateToVersion };
+    }));
+  } catch { return []; }
+}
+
+export async function scanWpThemes(page, origin) {
+  try {
+    await page.goto(new URL('/wp-admin/themes.php', origin).toString(), { waitUntil: 'domcontentloaded', timeout: 30000 });
+    const html = await page.content();
+    const m = /_wpThemeSettings\s*=\s*(\{[\s\S]*?\});/.exec(html);
+    if (!m) return [];
+    const settings = JSON.parse(m[1]);
+    const themes = settings.themes || [];
+    return themes.map((t) => ({
+      slug: t.id, name: t.name, version: t.version, active: !!t.active,
+      updateAvailable: !!(t.update && t.update.new_version), updateToVersion: t.update?.new_version || null,
+    }));
+  } catch { return []; }
+}
+
+export async function scanWpCoreAndPhp(page, origin) {
+  const result = { wpVersion: null, phpVersion: null, mysqlVersion: null, source: null };
+  try {
+    await page.goto(new URL('/wp-admin/index.php', origin).toString(), { waitUntil: 'domcontentloaded', timeout: 30000 });
+    const footerHtml = await page.content();
+    const wpM = /Version\s+([\d.]+(?:-[\w.]+)?)/i.exec(footerHtml);
+    if (wpM) { result.wpVersion = wpM[1]; result.source = 'admin footer'; }
+  } catch {}
+  try {
+    await page.goto(new URL('/wp-admin/site-health.php?tab=debug', origin).toString(), { waitUntil: 'domcontentloaded', timeout: 30000 });
+    const html = await page.content();
+    const phpM = /PHP [Vv]ersion<\/td>\s*<td[^>]*>\s*([\d.]+)/.exec(html) || /"php_version"[^"]*"\s*:\s*"([\d.]+)"/.exec(html);
+    if (phpM) result.phpVersion = phpM[1];
+    const mysqlM = /(?:MySQL|Database) [Vv]ersion<\/td>\s*<td[^>]*>\s*([\d.a-zA-Z-]+)/.exec(html);
+    if (mysqlM) result.mysqlVersion = mysqlM[1];
+    const wpHealthM = /WordPress [Vv]ersion<\/td>\s*<td[^>]*>\s*([\d.]+)/.exec(html);
+    if (wpHealthM && !result.wpVersion) { result.wpVersion = wpHealthM[1]; result.source = 'site health'; }
+  } catch {}
+  return result;
+}
+
+export async function scanWpUsers(page, origin) {
+  try {
+    await page.goto(new URL('/wp-admin/users.php', origin).toString(), { waitUntil: 'domcontentloaded', timeout: 30000 });
+    return await page.$$eval('#the-list tr', (rows) => rows.map((row) => {
+      const username = row.querySelector('.username strong, .column-username strong, .column-username a')?.textContent?.trim() || '';
+      const role = row.querySelector('.role')?.textContent?.trim() || '';
+      return { username, role };
+    }).filter((u) => u.username));
+  } catch { return []; }
+}
+
+export function detectSecurityPlugins(plugins = []) {
+  const found = plugins.filter((p) => KNOWN_SECURITY_PLUGIN_SLUGS.includes(p.slug) && p.active);
+  return found.map((p) => p.name);
+}
+
+// End-of-life minor versions per php.net/supported-versions.php. PHP 8.2's security support runs
+// through Dec 2026 and is intentionally left off this list until that date passes.
+const EOL_PHP_MINORS = new Set(['5.6', '7.0', '7.1', '7.2', '7.3', '7.4', '8.0', '8.1']);
+export function checkPhpEol(phpVersion) {
+  if (!phpVersion) return null;
+  const minor = (phpVersion.match(/^(\d+\.\d+)/) || [])[1];
+  return minor ? EOL_PHP_MINORS.has(minor) : null;
+}

package/scripts/lib/wp-plugin-directory.mjs

@@ -0,0 +1,58 @@
+// ── Official wordpress.org Plugin/Theme Directory API — used to determine whether an installed
+// version is outdated. This replaces scraping wp-admin's "View version X details" update-nag markup
+// (which is UI text, not a stable contract) with a public, versioned API endpoint. ──
+
+async function safeFetchJson(url, { timeoutMs = 8000 } = {}) {
+  const controller = new AbortController();
+  const t = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetch(url, { headers: { 'user-agent': 'Universal-Security-Audit' }, signal: controller.signal });
+    clearTimeout(t);
+    if (!res.ok) return null;
+    return await res.json();
+  } catch { clearTimeout(t); return null; }
+}
+
+export async function lookupLatestPluginVersion(slug) {
+  const data = await safeFetchJson(`https://api.wordpress.org/plugins/info/1.0/${encodeURIComponent(slug)}.json`);
+  if (!data || !data.version) return null;
+  return { latestVersion: data.version, name: data.name, lastUpdated: data.last_updated || null, activeInstalls: data.active_installs ?? null };
+}
+
+export async function lookupLatestThemeVersion(slug) {
+  const url = `https://api.wordpress.org/themes/info/1.2/?action=theme_information&request[slug]=${encodeURIComponent(slug)}`;
+  const data = await safeFetchJson(url);
+  if (!data || !data.version) return null;
+  return { latestVersion: data.version, name: data.name };
+}
+
+function semverLt(a, b) {
+  const pa = String(a || '0').split('.').map((n) => parseInt(n, 10) || 0);
+  const pb = String(b || '0').split('.').map((n) => parseInt(n, 10) || 0);
+  for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+    const x = pa[i] || 0, y = pb[i] || 0;
+    if (x < y) return true;
+    if (x > y) return false;
+  }
+  return false;
+}
+
+// Cross-references a list of {slug, version} against the plugin directory API, with modest
+// concurrency since this is one HTTP call per installed plugin/theme.
+export async function checkOutdatedAgainstDirectory(items, lookupFn, { concurrency = 4 } = {}) {
+  const results = [];
+  const queue = [...items];
+  async function worker() {
+    while (queue.length) {
+      const item = queue.shift();
+      const info = await lookupFn(item.slug);
+      if (info && item.version) {
+        results.push({ ...item, latestVersion: info.latestVersion, outdated: semverLt(item.version, info.latestVersion) });
+      } else {
+        results.push({ ...item, latestVersion: info?.latestVersion ?? null, outdated: null });
+      }
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(concurrency, queue.length || 1) }, worker));
+  return results;
+}

package/scripts/lib/wp-rest-audit.mjs

@@ -0,0 +1,59 @@
+// ── Authenticated WordPress audit via the official REST API + Application Passwords, instead of
+// scraping wp-admin HTML. This is the preferred path when an Application Password is supplied: it's
+// stable across WP core/admin-theme changes, doesn't need Playwright at all, and only reads data the
+// authenticated user already has REST capability to see (edit_plugins/list_users/etc). ──
+
+function authHeader(appUser, appPassword) {
+  const token = Buffer.from(`${appUser}:${appPassword}`).toString('base64');
+  return { Authorization: `Basic ${token}`, 'user-agent': 'Universal-Security-Audit' };
+}
+
+async function restGet(origin, path, appUser, appPassword, { timeoutMs = 15000 } = {}) {
+  const controller = new AbortController();
+  const t = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetch(new URL(path, origin).toString(), { headers: authHeader(appUser, appPassword), signal: controller.signal });
+    clearTimeout(t);
+    if (!res.ok) return { ok: false, status: res.status, error: await res.text().catch(() => '') };
+    return { ok: true, status: res.status, data: await res.json() };
+  } catch (e) {
+    clearTimeout(t);
+    return { ok: false, status: 0, error: String(e?.message || e) };
+  }
+}
+
+export async function verifyWpAppCredentials(origin, appUser, appPassword) {
+  const res = await restGet(origin, '/wp-json/wp/v2/users/me?context=edit', appUser, appPassword);
+  return { ok: res.ok, roles: res.ok ? res.data.roles || [] : [], error: res.error };
+}
+
+export async function wpRestPlugins(origin, appUser, appPassword) {
+  const res = await restGet(origin, '/wp-json/wp/v2/plugins', appUser, appPassword);
+  if (!res.ok) return { ok: false, error: res.error, plugins: [] };
+  const plugins = (res.data || []).map((p) => ({
+    slug: String(p.plugin || '').split('/')[0],
+    name: p.name?.replace(/<[^>]+>/g, '') || p.plugin,
+    active: p.status === 'active',
+    version: p.version || null,
+  }));
+  return { ok: true, plugins };
+}
+
+export async function wpRestThemes(origin, appUser, appPassword) {
+  const res = await restGet(origin, '/wp-json/wp/v2/themes?status=active,inactive', appUser, appPassword);
+  if (!res.ok) return { ok: false, error: res.error, themes: [] };
+  const themes = (res.data || []).map((t) => ({
+    slug: t.stylesheet,
+    name: t.name?.rendered || t.name?.raw || t.stylesheet,
+    active: t.status === 'active',
+    version: t.version || null,
+  }));
+  return { ok: true, themes };
+}
+
+export async function wpRestUsers(origin, appUser, appPassword) {
+  const res = await restGet(origin, '/wp-json/wp/v2/users?context=edit&per_page=100', appUser, appPassword);
+  if (!res.ok) return { ok: false, error: res.error, users: [] };
+  const users = (res.data || []).map((u) => ({ username: u.slug || u.name, role: (u.roles || []).join(', ') }));
+  return { ok: true, users };
+}

package/scripts/run-batch-audit.mjs

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+// Runs the full security audit across a list of sites, aggregating a summary table. Each site still
+// gets its own normal reports/<site>-<timestamp>/ directory with all the usual CSVs/HTML/PDF — this
+// just adds a rollup on top by running each child with --json and parsing its clean stdout.
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+function parseArgs(argv) {
+  const args = {};
+  for (let i = 2; i < argv.length; i++) {
+    const a = argv[i];
+    if (!a.startsWith('--')) continue;
+    const key = a.replace(/^--/, '');
+    const next = argv[i + 1];
+    if (!next || next.startsWith('--')) args[key] = true;
+    else { args[key] = next; i++; }
+  }
+  return args;
+}
+function esc(s) { s = String(s ?? ''); return /[",\n]/.test(s) ? '"' + s.replace(/"/g, '""') + '"' : s; }
+function writeCsv(rows, columns, outPath) {
+  const body = [columns.join(','), ...rows.map((r) => columns.map((c) => esc(r[c])).join(','))].join('\n') + '\n';
+  fs.writeFileSync(outPath, body, 'utf8');
+}
+
+const args = parseArgs(process.argv);
+if (!args['sites-file']) { console.error('Missing --sites-file'); process.exit(1); }
+const sitesFile = path.resolve(process.cwd(), args['sites-file']);
+const sites = fs.readFileSync(sitesFile, 'utf8').split(/\r?\n/g).map((l) => l.trim()).filter((l) => l && !l.startsWith('#'));
+if (!sites.length) { console.error('No sites found in --sites-file'); process.exit(1); }
+
+const concurrency = args.concurrency ? Number(args.concurrency) : 1;
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const auditScript = path.join(__dirname, 'run-security-audit.mjs');
+
+// Everything except our own batch-only flags gets forwarded to each child audit run.
+const OWN_FLAGS = new Set(['sites-file', 'concurrency', 'out-dir']);
+const passthrough = [];
+for (const [key, val] of Object.entries(args)) {
+  if (OWN_FLAGS.has(key)) continue;
+  passthrough.push(`--${key}`);
+  if (val !== true) passthrough.push(String(val));
+}
+
+function runOne(site) {
+  return new Promise((resolve) => {
+    const child = spawn(process.execPath, [auditScript, '--site', site, '--json', ...passthrough], { stdio: ['ignore', 'pipe', 'inherit'] });
+    let stdout = '';
+    child.stdout.on('data', (d) => { stdout += d; });
+    child.on('close', (code) => {
+      let report = null;
+      try { report = JSON.parse(stdout); } catch {}
+      resolve({ site, exitCode: code, report });
+    });
+  });
+}
+
+console.log(`Running batch audit across ${sites.length} site(s) (concurrency ${concurrency})...`);
+const results = [];
+const queue = [...sites];
+async function worker() {
+  while (queue.length) {
+    const site = queue.shift();
+    console.log(`→ ${site}`);
+    results.push(await runOne(site));
+  }
+}
+await Promise.all(Array.from({ length: Math.min(concurrency, sites.length) }, worker));
+
+const outDir = args['out-dir'] ? path.resolve(process.cwd(), args['out-dir']) : path.resolve('reports');
+fs.mkdirSync(outDir, { recursive: true });
+const batchId = Date.now();
+
+const rows = results.map((r) => ({
+  site: r.site,
+  status: r.report ? 'completed' : 'failed',
+  platform: r.report?.primaryPlatform || '',
+  grade: r.report?.risk?.grade || '',
+  score: r.report?.risk?.score ?? '',
+  critical: r.report?.risk?.counts?.critical ?? '',
+  high: r.report?.risk?.counts?.high ?? '',
+  medium: r.report?.risk?.counts?.medium ?? '',
+  low: r.report?.risk?.counts?.low ?? '',
+  info: r.report?.risk?.counts?.info ?? '',
+  exitCode: r.exitCode,
+}));
+rows.sort((a, b) => (a.score === '' ? 999 : a.score) - (b.score === '' ? 999 : b.score));
+
+const csvPath = path.join(outDir, `batch-summary-${batchId}.csv`);
+writeCsv(rows, ['site', 'status', 'platform', 'grade', 'score', 'critical', 'high', 'medium', 'low', 'info', 'exitCode'], csvPath);
+
+const failed = rows.filter((r) => r.status === 'failed');
+const md = [
+  '# Batch Security Audit Summary', '',
+  `Sites scanned: ${sites.length} · Completed: ${rows.length - failed.length} · Failed: ${failed.length}`, '',
+  '| Site | Grade | Score | Critical | High | Medium | Low | Info |',
+  '| --- | --- | --- | --- | --- | --- | --- | --- |',
+  ...rows.map((r) => `| ${r.site} | ${r.grade} | ${r.score} | ${r.critical} | ${r.high} | ${r.medium} | ${r.low} | ${r.info} |`),
+].join('\n');
+const mdPath = path.join(outDir, `batch-summary-${batchId}.md`);
+fs.writeFileSync(mdPath, md, 'utf8');
+
+console.log('');
+console.log(`Wrote: ${csvPath}`);
+console.log(`Wrote: ${mdPath}`);
+if (failed.length) {
+  console.error(`${failed.length} site(s) failed: ${failed.map((f) => f.site).join(', ')}`);
+  process.exitCode = 1;
+}