Apache Tomcat 8

#!/usr/bin/env python3
# check_cve_2017_7674.py
# Determine likely exposure to CVE-2017-7674 on a Tomcat installation.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/error

import os
import re
import sys
from pathlib import Path

AFFECTED = {
    '7.0': ('7.0.41', '7.0.78'),
    '8.0': ('8.0.0.RC1', '8.0.44'),
    '8.5': ('8.5.0', '8.5.15'),
    '9.0': ('9.0.0.M1', '9.0.0.M21'),
}


def parse_version(v):
    v = v.strip()
    m = re.match(r'^(\d+)\.(\d+)\.(\d+)(?:[.-]?(RC|M)(\d+))?$', v, re.IGNORECASE)
    if not m:
        return None
    major, minor, patch, stage, stage_num = m.groups()
    major = int(major)
    minor = int(minor)
    patch = int(patch)
    if not stage:
        stage_rank = 2  # final release > milestone/rc of same numeric version
        stage_num = 0
    else:
        stage = stage.upper()
        stage_rank = 0 if stage == 'M' else 1  # M < RC < final
        stage_num = int(stage_num)
    return (major, minor, patch, stage_rank, stage_num)


def cmp_ver(a, b):
    pa = parse_version(a)
    pb = parse_version(b)
    if pa is None or pb is None:
        raise ValueError(f'Cannot compare versions: {a} vs {b}')
    return (pa > pb) - (pa < pb)


def version_in_range(v, lo, hi):
    return cmp_ver(v, lo) >= 0 and cmp_ver(v, hi) <= 0


def read_text_if_exists(p):
    try:
        return p.read_text(errors='ignore')
    except Exception:
        return None


def detect_version(tomcat_home: Path):
    candidates = [
        tomcat_home / 'RELEASE-NOTES',
        tomcat_home / 'RUNNING.txt',
        tomcat_home / 'bin' / 'catalina.sh',
        tomcat_home / 'lib' / 'catalina.jar',
        tomcat_home / 'lib' / 'tomcat-coyote.jar',
    ]

    # Best effort from text files first
    for p in candidates[:3]:
        txt = read_text_if_exists(p)
        if not txt:
            continue
        for pat in [r'Apache Tomcat Version\s+([0-9][^\s]+)', r'Apache Tomcat/([0-9][^\s]+)', r'\b([0-9]+\.[0-9]+\.[0-9]+(?:[.-]?(?:RC|M)[0-9]+)?)\b']:
            m = re.search(pat, txt, re.IGNORECASE)
            if m:
                return m.group(1)

    # Try manifest from jars without external deps
    import zipfile
    for p in candidates[3:]:
        if not p.exists():
            continue
        try:
            with zipfile.ZipFile(p) as zf:
                for name in ('META-INF/MANIFEST.MF',):
                    try:
                        data = zf.read(name).decode('utf-8', errors='ignore')
                    except Exception:
                        continue
                    for pat in [r'Implementation-Version:\s*([^\s]+)', r'Specification-Version:\s*([^\s]+)']:
                        m = re.search(pat, data, re.IGNORECASE)
                        if m:
                            return m.group(1)
        except Exception:
            pass
    return None


def branch_key(v):
    pv = parse_version(v)
    if not pv:
        return None
    return f'{pv[0]}.{pv[1]}'


def find_corsfilter_usage(tomcat_home: Path):
    hits = []
    search_roots = [tomcat_home / 'conf', tomcat_home / 'webapps']
    needles = [
        'org.apache.catalina.filters.CorsFilter',
        '<filter-class>org.apache.catalina.filters.CorsFilter</filter-class>',
        'CorsFilter'
    ]
    for root in search_roots:
        if not root.exists():
            continue
        for path in root.rglob('*.xml'):
            txt = read_text_if_exists(path)
            if not txt:
                continue
            if any(n in txt for n in needles):
                hits.append(str(path))
    return hits


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 check_cve_2017_7674.py <TOMCAT_HOME>')
        sys.exit(3)

    tomcat_home = Path(sys.argv[1]).resolve()
    if not tomcat_home.exists() or not tomcat_home.is_dir():
        print(f'UNKNOWN - invalid TOMCAT_HOME: {tomcat_home}')
        sys.exit(3)

    version = detect_version(tomcat_home)
    if not version:
        print('UNKNOWN - could not determine Tomcat version from installation files')
        sys.exit(2)

    key = branch_key(version)
    if key not in AFFECTED:
        print(f'PATCHED - Tomcat version {version} is outside known affected branches for CVE-2017-7674')
        sys.exit(0)

    lo, hi = AFFECTED[key]
    if not version_in_range(version, lo, hi):
        print(f'PATCHED - Tomcat version {version} is not in the vulnerable range {lo}..{hi}')
        sys.exit(0)

    hits = find_corsfilter_usage(tomcat_home)
    if hits:
        sample = '; '.join(hits[:5])
        more = '' if len(hits) <= 5 else f' (+{len(hits)-5} more)'
        print(f'VULNERABLE - Tomcat {version} is in affected range and CorsFilter was found in: {sample}{more}')
        sys.exit(1)

    print(f'UNKNOWN - Tomcat {version} is in affected range, but no CorsFilter reference was found in scanned XML files; verify custom app wiring and proxy cache behavior manually')
    sys.exit(2)


if __name__ == '__main__':
    main()