Apache Tomcat RewriteValve [OR] short-circuit skips trailing AND RewriteCond evaluation

#!/usr/bin/env bash
# check-cve-2026-53404.sh — Tomcat RewriteValve [OR] short-circuit
# Usage: ./check-cve-2026-53404.sh <CATALINA_HOME>
set -u
CATALINA_HOME="${1:-/opt/tomcat}"

if [[ ! -d "$CATALINA_HOME" ]]; then
  echo "UNKNOWN: $CATALINA_HOME not found"; exit 2
fi

# 1) Version detection
VER="$("$CATALINA_HOME/bin/version.sh" 2>/dev/null | awk -F': ' '/Server number/ {print $2}')"
if [[ -z "$VER" ]]; then
  echo "UNKNOWN: cannot determine Tomcat version"; exit 2
fi

# 2) Compare against fixed versions
vuln=0
IFS='.' read -r MA MI PA <<<"$VER"
case "$MA" in
  9)  [[ "$MI" -eq 0 && "$PA" -lt 119 ]] && vuln=1 ;;
  11) [[ "$MI" -eq 0 && "$PA" -lt 23 ]]  && vuln=1 ;;
  *)  : ;;  # 10.1 / 8.5 / future — confirm via advisory
esac

# 3) RewriteValve usage check
rv=0
rx=0
while IFS= read -r f; do
  grep -lq 'org.apache.catalina.valves.rewrite.RewriteValve' "$f" && rv=1
done < <(find "$CATALINA_HOME" -type f \( -name 'server.xml' -o -name 'context.xml' \) 2>/dev/null)

while IFS= read -r cfg; do
  if grep -qE '^[[:space:]]*RewriteCond[^#]*\[OR\]' "$cfg" \
     && grep -qE '^[[:space:]]*RewriteCond[^#]*$' "$cfg"; then
    rx=1
  fi
done < <(find "$CATALINA_HOME" -type f -name 'rewrite.config' 2>/dev/null)

# 4) Verdict
if [[ $vuln -eq 0 ]]; then
  echo "PATCHED: Tomcat $VER is at or above fixed release"
  exit 0
fi

if [[ $rv -eq 1 && $rx -eq 1 ]]; then
  echo "VULNERABLE: Tomcat $VER, RewriteValve enabled, mixed [OR]+AND RewriteCond present"
  exit 1
elif [[ $rv -eq 1 ]]; then
  echo "VULNERABLE (low impact): Tomcat $VER with RewriteValve enabled; no mixed-OR ruleset found, but patch recommended"
  exit 1
else
  echo "PATCHED (effective): Tomcat $VER vulnerable build, but RewriteValve not enabled — defect unreachable"
  exit 0
fi