# 1️⃣ Create a virtual environment (optional but recommended)
python -m venv venv
source venv/bin/activate   # on Windows: venv\Scripts\activate

# 2️⃣ Install required packages
pip install --upgrade pip
pip install requests python-dotenv

# 1️⃣ Initialise a new Node project (skip if you already have one)
npm init -y          # or: yarn init -y

# 2️⃣ Install dependencies
npm install axios dotenv   # for plain JS
# If you prefer TypeScript:
npm install --save-dev typescript @types/node ts-node
npx tsc --init            # creates tsconfig.json

#!/usr/bin/env python3
"""
check_ise_patch.py
------------------
Verifies whether the Cisco ISE instance is running a version that includes
the critical command‑execution patch.

Requires:
    - requests
    - python-dotenv
"""

import os
import sys
import logging
from typing import Tuple

import requests
from dotenv import load_dotenv

# ----------------------------------------------------------------------
# Configuration (loaded from .env)
# ----------------------------------------------------------------------
load_dotenv()  # pulls variables from .env into os.environ

ISE_HOST = os.getenv("ISE_HOST")          # e.g., ise.example.com
ISE_USER = os.getenv("ISE_USER")
ISE_PASSWORD = os.getenv("ISE_PASSWORD")
ISE_PORT = int(os.getenv("ISE_PORT", "9060"))  # default REST API port
USE_SSL_VERIFY = os.getenv("ISE_SSL_VERIFY", "true").lower() == "true"

# Minimum version that contains the fix (adjust per advisory)
# Format: major.minor.patch (as returned by ISE /api/system/version)
PATCHED_VERSION: Tuple[int, int, int] = (3, 1, 2)   # Example: ISE 3.1 Patch 2

# ----------------------------------------------------------------------
# Logging setup
# ----------------------------------------------------------------------
logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s %(levelname)s %(name)s - %(message)s",
)
log = logging.getLogger(__name__)

# ----------------------------------------------------------------------
# Helper functions
# ----------------------------------------------------------------------
def get_auth_token() -> str:
    """
    Obtain an ERS API token using basic auth.
    Returns the token string.
    """
    url = f"https://{ISE_HOST}:{ISE_PORT}/ers/config/systeminfo"
    # The /systeminfo endpoint does NOT require a token, but we use it to
    # trigger auth and capture the returned token header.
    resp = requests.get(
        url,
        auth=(ISE_USER, ISE_PASSWORD),
        verify=USE_SSL_VERIFY,
        timeout=10,
    )
    resp.raise_for_status()
    # ISE returns the token in the header 'X-ERSAPI-Authenticated-User'
    # but the actual token is needed for subsequent calls via the
    # 'ERS-API' header (or we can reuse basic auth). For simplicity we
    # continue with basic auth; the token extraction is shown for completeness.
    token = resp.headers.get("X-ERSAPI-Authenticated-User")
    if token:
        log.debug("Authenticated as %s", token)
    return token  # not strictly needed for the demo


def fetch_system_version() -> Tuple[int, int, int]:
    """
    Calls the ISE REST API to retrieve the system version.
    Returns a tuple (major, minor, patch).
    """
    url = f"https://{ISE_HOST}:{ISE_PORT}/api/system/version"
    resp = requests.get(
        url,
        auth=(ISE_USER, ISE_PASSWORD),
        verify=USE_SSL_VERIFY,
        timeout=10,
    )
    resp.raise_for_status()
    data = resp.json()
    # Expected JSON: {"version": "3.1.2.0", "buildDate": "2024-04-01", ...}
    version_str = data.get("version", "0.0.0")
    # Strip any extra build metadata (e.g., "3.1.2.0" -> "3.1.2")
    core_version = ".".join(version_str.split(".")[:3])
    try:
        major, minor, patch = map(int, core_version.split("."))
    except ValueError as exc:
        log.error("Unable to parse version string '%s': %s", version_str, exc)
        raise
    log.info("ISE reports version %s.%s.%s", major, minor, patch)
    return major, minor, patch


def is_patched(current: Tuple[int, int, int]) -> bool:
    """
    Simple semantic‑version comparison: returns True if current >= PATCHED_VERSION.
    """
    return current >= PATCHED_VERSION


# ----------------------------------------------------------------------
# Main execution
# ----------------------------------------------------------------------
def main() -> int:
    try:
        # Optional: obtain a token (demonstrates auth flow)
        get_auth_token()
        version = fetch_system_version()
        if is_patched(version):
            print(f"✅ ISE version {'.'.join(map(str, version)}} is **patched** (≥ {'.'.join(map(str, PATCHED_VERSION))}).")
            return 0
        else:
            print(
                f"⚠️  ISE version {'.'.join(map(str, version)}} is **older** than the patched version "
                f"{'.'.join(map(str, PATCHED_VERSION))}. Please upgrade immediately."
            )
            return 1
    except requests.exceptions.RequestException as exc:
        log.error("HTTP request failed: %s", exc)
        return 2
    except Exception as exc:  # pragma: no cover – defensive
        log.exception("Unexpected error: %s", exc)
        return 3


if __name__ == "__main__":
    sys.exit(main())

# 1️⃣ Create .env (see Step 4)
cp .env.example .env   # then edit .env with your values

# 2️⃣ Execute
python check_ise_patch.py

/**
 * checkIsePatch.js
 * ----------------
 * Node.js script that validates whether a Cisco ISE instance is running a
 * version that includes the critical command‑execution patch.
 *
 * Requires:
 *   - axios
 *   - dotenv
 */

require('dotenv').config(); // loads .env into process.env
const axios = require('axios');
const { log, error } = require('console');

// ----------------------------------------------------------------------
// Configuration from environment
// ----------------------------------------------------------------------
const ISE_HOST = process.env.ISE_HOST;
const ISE_USER = process.env.ISE_USER;
const ISE_PASSWORD = process.env.ISE_PASSWORD;
const ISE_PORT = parseInt(process.env.ISE_PORT) || 9060;
const SSL_VERIFY = process.env.ISE_SSL_VERIFY !== 'false';

// Minimum version that contains the fix (adjust per advisory)
const PATCHED_VERSION = [3, 1, 2]; // Example: ISE 3.1 Patch 2

// ----------------------------------------------------------------------
// Helper: semantic version compare (returns true if a >= b)
// ----------------------------------------------------------------------
function versionAtLeast(current, required) {
  for (let i = 0; i < 3; i++) {
    if (current[i] > required[i]) return true;
    if (current[i] < required[i]) return false;
  }
  return true; // equal
}

// ----------------------------------------------------------------------
// Main
// ----------------------------------------------------------------------
(async () => {
  try {
    const baseURL = `https://${ISE_HOST}:${ISE_PORT}`;

    // Optional: verify connectivity via /systeminfo (no token needed)
    await axios.get(`${baseURL}/ers/config/systeminfo`, {
      auth: { username: ISE_USER, password: ISE_PASSWORD },
      validateStatus: status => status < 500, // treat 4xx as resolvable
      httpsAgent: new (require('https')).Agent({ rejectUnauthorized: SSL_VERIFY }),
      timeout: 10000,
    });

    // Fetch version
    const { data } = await axios.get(`${baseURL}/api/system/version`, {
      auth: { username: ISE_USER, password: ISE_PASSWORD },
      validateStatus: status => status < 500,
      httpsAgent: new (require('https')).Agent({ rejectUnauthorized: SSL_VERIFY }),
      timeout: 10000,
    });

    // Expected shape: { version: "3.1.2.0", ... }
    const rawVersion = data.version || '0.0.0';
    const [major, minor, patch] = rawVersion
      .split('.')
      .slice(0, 3)
      .map(v => parseInt(v, 10));

    log.info(`ISE reports version ${major}.${minor}.${patch}`);

    const current = [major, minor, patch];
    if (versionAtLeast(current, PATCHED_VERSION)) {
      console.log(
        `✅ ISE version ${major}.${minor}.${patch} is **patched** (≥ ${PATCHED_VERSION.join('.')}).`
      );
      process.exit(0);
    } else {
      console.warn(
        `⚠️  ISE version ${major}.${minor}.${patch} is **older** than the patched version ${PATCHED_VERSION.join(
          '.'
        )}. Please upgrade immediately.`
      );
      process.exit(1);
    }
  } catch (err) {
    if (err.isAxiosError) {
      error(`HTTP error: ${err.message}`);
      if (err.response) {
        error(`Status: ${err.response.status}`);
        error(`Data: ${JSON.stringify(err.response.data)}`);
      }
    } else {
      error(`Unexpected error: ${err}`);
    }
    process.exit(2);
  }
})();

# 1️⃣ Create .env (see Step 4)
cp .env.example .env   # edit with your values

# 2️⃣ Execute
node checkIsePatch.js

# .env.example – copy to .env and fill in your values
ISE_HOST=ise.example.com          # hostname or IP of the ISE admin node
ISE_USER=api_admin                # a user with ERS/API admin rights
ISE_PASSWORD=SuperSecretPassword! # password or API token (if using token auth)
ISE_PORT=9060                     # default REST API port; change if you customized
ISE_SSL_VERIFY=true               # set to false only for self‑signed certs (dev only)

# Python
headers = {"Authorization": f"Bearer {process.env.ISE_TOKEN}"}

// JavaScript
headers: { Authorization: `Bearer ${process.env.ISE_TOKEN}` }

# Python
export PYTHONWARNINGS="default"
python -Wd check_ise_patch.py   # shows warnings, including insecure request warnings

# Node
DEBUG=axios node checkIsePatch.js