A vulnerability in the JNDI Realm of Apache Tomcat

#!/usr/bin/env python3
# check_cve_2021_30640.py
# Determine whether this Tomcat instance is exposed to CVE-2021-30640.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import re
import sys
import zipfile
import xml.etree.ElementTree as ET

AFFECTED = [
    ((7, 0, 0), (7, 0, 109)),
    ((8, 5, 0), (8, 5, 66)),
    ((9, 0, 0), (9, 0, 46)),
    ((10, 0, 0), (10, 0, 6)),
]


def normalize_version(s):
    if not s:
        return None
    s = s.strip()
    s = s.replace('Tomcat/', '')
    s = s.replace('Apache Tomcat/', '')
    s = s.replace('Apache Tomcat', '')
    s = s.strip()
    # Handle milestone / M notation by stripping non-numeric separators after capturing digits.
    nums = re.findall(r'\d+', s)
    if len(nums) < 2:
        return None
    parts = [int(x) for x in nums[:3]]
    while len(parts) < 3:
        parts.append(0)
    return tuple(parts)


def version_in_affected(v):
    for low, high in AFFECTED:
        if v >= low and v < high:
            return True
    return False


def find_version(base):
    candidates = [
        os.path.join(base, 'RELEASE-NOTES'),
        os.path.join(base, 'RUNNING.txt'),
        os.path.join(base, 'lib', 'catalina.jar'),
        os.path.join(base, 'bin', 'version.sh'),
        os.path.join(base, 'bin', 'version.bat'),
    ]

    # Text files first
    for path in candidates[:2]:
        if os.path.isfile(path):
            try:
                with open(path, 'r', encoding='utf-8', errors='ignore') as f:
                    data = f.read()
                m = re.search(r'Apache Tomcat(?:/|\s+)([0-9][0-9A-Za-z.\-M]*)', data)
                if m:
                    return m.group(1)
            except Exception:
                pass

    # catalina.jar manifest
    jar = candidates[2]
    if os.path.isfile(jar):
        try:
            with zipfile.ZipFile(jar, 'r') as zf:
                with zf.open('META-INF/MANIFEST.MF') as mf:
                    data = mf.read().decode('utf-8', errors='ignore')
                for line in data.splitlines():
                    if line.startswith('Implementation-Version:'):
                        return line.split(':', 1)[1].strip()
        except Exception:
            pass

    # version scripts as a last resort
    for path in candidates[3:]:
        if os.path.isfile(path):
            try:
                with open(path, 'r', encoding='utf-8', errors='ignore') as f:
                    data = f.read()
                m = re.search(r'([0-9]+\.[0-9]+\.[0-9]+)', data)
                if m:
                    return m.group(1)
            except Exception:
                pass

    return None


def has_jndirealm(server_xml):
    try:
        tree = ET.parse(server_xml)
        root = tree.getroot()
        for elem in root.iter():
            if elem.tag.endswith('Realm'):
                cn = elem.attrib.get('className', '')
                if cn == 'org.apache.catalina.realm.JNDIRealm':
                    return True
        return False
    except Exception:
        return None


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 check_cve_2021_30640.py <CATALINA_BASE>')
        sys.exit(2)

    base = sys.argv[1]
    server_xml = os.path.join(base, 'conf', 'server.xml')

    if not os.path.exists(base):
        print(f'UNKNOWN - path does not exist: {base}')
        sys.exit(2)

    if not os.path.isfile(server_xml):
        print(f'UNKNOWN - cannot find {server_xml}')
        sys.exit(2)

    jndi = has_jndirealm(server_xml)
    if jndi is None:
        print(f'UNKNOWN - failed to parse {server_xml}')
        sys.exit(2)

    if not jndi:
        print('PATCHED - JNDIRealm not configured on this Tomcat instance; CVE-2021-30640 not reachable here')
        sys.exit(0)

    raw_ver = find_version(base)
    norm_ver = normalize_version(raw_ver) if raw_ver else None

    if norm_ver is None:
        print('UNKNOWN - JNDIRealm is configured but Tomcat version could not be determined')
        sys.exit(2)

    if version_in_affected(norm_ver):
        print(f'VULNERABLE - JNDIRealm configured and Tomcat version appears affected ({raw_ver})')
        sys.exit(1)
    else:
        print(f'PATCHED - JNDIRealm configured but Tomcat version appears fixed/not affected ({raw_ver})')
        sys.exit(0)


if __name__ == '__main__':
    main()