iText PDF XML external entity processing in crafted PDF/XFA content

#!/usr/bin/env python3
# check_cve_2017_9096_itext.py
# Detect likely vulnerable iText artifacts for CVE-2017-9096.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import re
import sys
import json
import zipfile
from pathlib import Path

VULN_FOUND = []
PATCHED_FOUND = []
UNKNOWN_FOUND = []

JAR_NAME_RE = re.compile(r'(itextpdf|itext|itext7)[-_]?([0-9][0-9A-Za-z._-]*)?\.jar$', re.I)
DLL_NAME_RE = re.compile(r'(itextsharp|itext7)[._-]?([0-9][0-9A-Za-z._-]*)?\.dll$', re.I)
NUPKG_RE = re.compile(r'(itextsharp|itext7)[._-]?([0-9][0-9A-Za-z._-]*)?\.nupkg$', re.I)


def normalize(v):
    if not v:
        return []
    v = v.strip().lower()
    v = v.replace('+', '.')
    parts = re.split(r'[^0-9]+', v)
    nums = [int(p) for p in parts if p != '']
    return nums


def cmp_ver(a, b):
    aa = normalize(a)
    bb = normalize(b)
    maxlen = max(len(aa), len(bb))
    aa += [0] * (maxlen - len(aa))
    bb += [0] * (maxlen - len(bb))
    if aa < bb:
        return -1
    if aa > bb:
        return 1
    return 0


def classify_itext_version(version, package_hint=''):
    if not version:
        return 'UNKNOWN'
    hint = package_hint.lower()
    # Legacy GHSA note: com.lowagie:itext <= 4.2.2 has no fix
    if 'lowagie' in hint:
        if cmp_ver(version, '4.2.2') <= 0:
            return 'VULNERABLE'
        return 'UNKNOWN'
    # iText 7 range: 7.0.0 - 7.0.2 vulnerable, 7.0.3+ patched
    if cmp_ver(version, '7.0.0') >= 0:
        if cmp_ver(version, '7.0.3') < 0:
            return 'VULNERABLE'
        return 'PATCHED'
    # iText 5 and earlier: < 5.5.12 vulnerable, 5.5.12+ patched
    if cmp_ver(version, '5.5.12') < 0:
        return 'VULNERABLE'
    return 'PATCHED'


def record(state, path, version, detail):
    item = {'path': str(path), 'version': version or '', 'detail': detail}
    if state == 'VULNERABLE':
        VULN_FOUND.append(item)
    elif state == 'PATCHED':
        PATCHED_FOUND.append(item)
    else:
        UNKNOWN_FOUND.append(item)


def scan_jar(path):
    version = None
    package_hint = ''
    try:
        with zipfile.ZipFile(path, 'r') as zf:
            for name in zf.namelist():
                low = name.lower()
                if low.endswith('pom.properties') and ('itext' in low or 'lowagie' in low):
                    data = zf.read(name).decode('utf-8', errors='ignore')
                    for line in data.splitlines():
                        if line.startswith('version='):
                            version = line.split('=', 1)[1].strip()
                        elif line.startswith('groupId='):
                            package_hint = line.split('=', 1)[1].strip()
                elif low.endswith('manifest.mf') and not version:
                    data = zf.read(name).decode('utf-8', errors='ignore')
                    for line in data.splitlines():
                        if line.lower().startswith('implementation-version:'):
                            version = line.split(':', 1)[1].strip()
            if not version:
                m = JAR_NAME_RE.search(path.name)
                if m and m.group(2):
                    version = m.group(2)
        state = classify_itext_version(version, package_hint)
        record(state, path, version, f'jar package_hint={package_hint or "unknown"}')
    except Exception as e:
        record('UNKNOWN', path, version, f'jar read error: {e}')


def scan_deps_json(path):
    try:
        data = json.loads(path.read_text(encoding='utf-8', errors='ignore'))
    except Exception as e:
        record('UNKNOWN', path, None, f'deps.json read error: {e}')
        return
    libs = data.get('libraries', {})
    hit = False
    for key in libs.keys():
        low = key.lower()
        if low.startswith('itextsharp/') or low.startswith('itext7/'):
            hit = True
            name, version = key.split('/', 1)
            state = classify_itext_version(version, name)
            record(state, path, version, f'deps.json package={name}')
    if not hit:
        # no relevant package reference; stay silent
        pass


def scan_filename_only(path):
    m = DLL_NAME_RE.search(path.name) or NUPKG_RE.search(path.name)
    version = m.group(2) if m and m.group(2) else None
    state = classify_itext_version(version, path.stem)
    record(state, path, version, 'filename-based detection only')


def walk(root):
    for dirpath, _, filenames in os.walk(root):
        for fn in filenames:
            p = Path(dirpath) / fn
            low = fn.lower()
            if low.endswith('.jar') and 'itext' in low:
                scan_jar(p)
            elif low.endswith('.deps.json'):
                scan_deps_json(p)
            elif low.endswith('.dll') and ('itextsharp' in low or 'itext7' in low):
                scan_filename_only(p)
            elif low.endswith('.nupkg') and ('itextsharp' in low or 'itext7' in low):
                scan_filename_only(p)


def main():
    if len(sys.argv) < 2:
        print('UNKNOWN - usage: python3 check_cve_2017_9096_itext.py <path> [<path> ...]')
        sys.exit(2)

    for arg in sys.argv[1:]:
        if os.path.exists(arg):
            walk(arg)
        else:
            record('UNKNOWN', arg, None, 'path does not exist')

    if VULN_FOUND:
        print('VULNERABLE')
        for item in VULN_FOUND:
            print(f"[VULN] {item['path']} version={item['version']} detail={item['detail']}")
        for item in PATCHED_FOUND:
            print(f"[PATCHED] {item['path']} version={item['version']} detail={item['detail']}")
        for item in UNKNOWN_FOUND:
            print(f"[UNKNOWN] {item['path']} version={item['version']} detail={item['detail']}")
        sys.exit(1)

    if PATCHED_FOUND and not UNKNOWN_FOUND:
        print('PATCHED')
        for item in PATCHED_FOUND:
            print(f"[PATCHED] {item['path']} version={item['version']} detail={item['detail']}")
        sys.exit(0)

    print('UNKNOWN')
    for item in PATCHED_FOUND:
        print(f"[PATCHED] {item['path']} version={item['version']} detail={item['detail']}")
    for item in UNKNOWN_FOUND:
        print(f"[UNKNOWN] {item['path']} version={item['version']} detail={item['detail']}")
    sys.exit(2)


if __name__ == '__main__':
    main()