Apache Tomcat Tribes EncryptInterceptor fail-open bypass enabling unauthenticated RCE via deserialization

#!/usr/bin/env bash
# check_cve_2026_34486.sh — Detect CVE-2026-34486 exposure
# Usage: bash check_cve_2026_34486.sh /path/to/catalina_home
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

CATALINA_HOME="${1:-}"
if [ -z "$CATALINA_HOME" ]; then
  echo "Usage: $0 <CATALINA_HOME>"
  exit 2
fi

# --- Determine Tomcat version ---
VERSION_FILE="$CATALINA_HOME/lib/catalina.jar"
if [ ! -f "$VERSION_FILE" ]; then
  echo "[UNKNOWN] Cannot find catalina.jar at $CATALINA_HOME/lib/"
  exit 2
fi

VERSION=$(unzip -p "$VERSION_FILE" org/apache/catalina/util/ServerInfo.properties 2>/dev/null \
  | grep '^server.number=' | cut -d= -f2 | tr -d '[:space:]')

if [ -z "$VERSION" ]; then
  echo "[UNKNOWN] Could not extract Tomcat version from catalina.jar"
  exit 2
fi

echo "[INFO] Detected Tomcat version: $VERSION"

# --- Check if version is one of the three affected releases ---
VULN_VERSIONS="9.0.116 10.1.53 11.0.20"
IS_VULN_VERSION=false
for v in $VULN_VERSIONS; do
  if [ "$VERSION" = "$v" ]; then
    IS_VULN_VERSION=true
    break
  fi
done

if [ "$IS_VULN_VERSION" = false ]; then
  echo "[PATCHED] Tomcat $VERSION is not one of the affected versions (9.0.116, 10.1.53, 11.0.20)."
  exit 0
fi

echo "[WARNING] Tomcat $VERSION is an affected version."

# --- Check if Tribes clustering is enabled ---
SERVER_XML="$CATALINA_HOME/conf/server.xml"
if [ ! -f "$SERVER_XML" ]; then
  echo "[UNKNOWN] Cannot find server.xml at $SERVER_XML"
  exit 2
fi

CLUSTER_ENABLED=false
if grep -qiE '<Cluster\b|SimpleTcpCluster|DeltaManager|BackupManager' "$SERVER_XML" 2>/dev/null; then
  # Check it's not commented out
  if grep -E '<Cluster\b|SimpleTcpCluster' "$SERVER_XML" | grep -qvE '^\s*<!--'; then
    CLUSTER_ENABLED=true
  fi
fi

if [ "$CLUSTER_ENABLED" = false ]; then
  echo "[PATCHED] Tomcat $VERSION detected but Tribes clustering is NOT enabled in server.xml."
  echo "[INFO] The EncryptInterceptor bypass is not reachable without clustering. Low risk."
  exit 0
fi

echo "[WARNING] Tribes clustering IS enabled."

# --- Check if EncryptInterceptor is configured ---
ENCRYPT_CONFIGURED=false
if grep -qiE 'EncryptInterceptor' "$SERVER_XML" 2>/dev/null; then
  if grep -E 'EncryptInterceptor' "$SERVER_XML" | grep -qvE '^\s*<!--'; then
    ENCRYPT_CONFIGURED=true
  fi
fi

if [ "$ENCRYPT_CONFIGURED" = true ]; then
  echo "[WARNING] EncryptInterceptor IS configured — fail-open bypass is active."
else
  echo "[WARNING] EncryptInterceptor is NOT configured — cluster traffic is unencrypted."
  echo "[INFO] CVE-2026-34486 specifically requires EncryptInterceptor, but unencrypted"
  echo "       clustering is arguably worse (direct deserialization with no encryption at all)."
fi

# --- Check if receiver port is listening ---
RECEIVER_PORT=4000
CUSTOM_PORT=$(grep -oP 'Receiver[^>]*port="\K[0-9]+' "$SERVER_XML" 2>/dev/null | head -1)
if [ -n "$CUSTOM_PORT" ]; then
  RECEIVER_PORT=$CUSTOM_PORT
fi

PORT_OPEN=false
if command -v ss &>/dev/null; then
  if ss -ltnp 2>/dev/null | grep -q ":${RECEIVER_PORT} "; then
    PORT_OPEN=true
  fi
elif command -v netstat &>/dev/null; then
  if netstat -tlnp 2>/dev/null | grep -q ":${RECEIVER_PORT} "; then
    PORT_OPEN=true
  fi
fi

if [ "$PORT_OPEN" = true ]; then
  echo "[WARNING] Tribes receiver port $RECEIVER_PORT is LISTENING."
else
  echo "[INFO] Tribes receiver port $RECEIVER_PORT does not appear to be listening (Tomcat may not be running)."
fi

# --- Final verdict ---
echo ""
echo "=== RESULT ==="
if [ "$CLUSTER_ENABLED" = true ]; then
  echo "[VULNERABLE] Tomcat $VERSION with Tribes clustering enabled."
  echo "  Action: Upgrade immediately to 9.0.117 / 10.1.54 / 11.0.21+"
  echo "  Interim: Firewall port $RECEIVER_PORT to cluster members only."
  exit 1
else
  echo "[PATCHED] Vulnerable version detected but clustering not enabled. Not exploitable."
  exit 0
fi