Apache Tomcat 7

#!/usr/bin/env python3
# Check practical exposure to CVE-2018-8014 on Apache Tomcat.
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1 vulnerable, 0 patched, 2 unknown

import os
import re
import sys
import zipfile
import xml.etree.ElementTree as ET

NS = ''


def norm_tag(tag):
    if '}' in tag:
        return tag.split('}', 1)[1]
    return tag


def parse_version_from_text(text):
    m = re.search(r'Apache Tomcat/?\s*([0-9]+\.[0-9]+\.[0-9]+)', text, re.I)
    if m:
        return m.group(1)
    m = re.search(r'([0-9]+\.[0-9]+\.[0-9]+)', text)
    if m:
        return m.group(1)
    return None


def version_tuple(v):
    try:
        return tuple(int(x) for x in v.split('.'))
    except Exception:
        return None


def get_tomcat_version(base):
    candidates = [
        os.path.join(base, 'RELEASE-NOTES'),
        os.path.join(base, 'RUNNING.txt'),
        os.path.join(base, 'lib', 'catalina.jar'),
    ]
    for path in candidates:
        if not os.path.exists(path):
            continue
        try:
            if path.endswith('.jar'):
                with zipfile.ZipFile(path, 'r') as zf:
                    for name in ('META-INF/MANIFEST.MF', 'org/apache/catalina/util/ServerInfo.properties'):
                        try:
                            data = zf.read(name).decode('utf-8', 'ignore')
                            v = parse_version_from_text(data)
                            if v:
                                return v
                        except Exception:
                            pass
            else:
                with open(path, 'r', encoding='utf-8', errors='ignore') as fh:
                    data = fh.read(4096)
                    v = parse_version_from_text(data)
                    if v:
                        return v
        except Exception:
            pass
    return None


def parse_webxml(path):
    try:
        tree = ET.parse(path)
        root = tree.getroot()
    except Exception:
        return []

    filters = {}
    mappings = set()

    for elem in root.iter():
        tag = norm_tag(elem.tag)
        if tag == 'filter':
            fname = None
            fclass = None
            params = {}
            for child in list(elem):
                ctag = norm_tag(child.tag)
                text = (child.text or '').strip()
                if ctag == 'filter-name':
                    fname = text
                elif ctag == 'filter-class':
                    fclass = text
                elif ctag == 'init-param':
                    pname = None
                    pvalue = None
                    for p in list(child):
                        ptag = norm_tag(p.tag)
                        ptext = (p.text or '').strip()
                        if ptag == 'param-name':
                            pname = ptext
                        elif ptag == 'param-value':
                            pvalue = ptext
                    if pname:
                        params[pname] = pvalue or ''
            if fname:
                filters[fname] = {'class': fclass or '', 'params': params}

        elif tag == 'filter-mapping':
            fname = None
            for child in list(elem):
                if norm_tag(child.tag) == 'filter-name':
                    fname = (child.text or '').strip()
            if fname:
                mappings.add(fname)

    findings = []
    for fname, meta in filters.items():
        if meta['class'] == 'org.apache.catalina.filters.CorsFilter' and fname in mappings:
            params = {k.lower(): v for k, v in meta['params'].items()}
            allowed = params.get('cors.allowed.origins', '').strip()
            creds = params.get('cors.support.credentials', '').strip().lower()

            # Practical exposure heuristic:
            # - missing cors.support.credentials => default used
            # - missing/empty/* allowed origins => permissive default or equivalent
            creds_default_or_true = (creds == '' or creds == 'true')
            origins_default_or_wild = (allowed == '' or allowed == '*')
            explicitly_safer = (creds == 'false') or (allowed not in ('', '*'))

            findings.append({
                'file': path,
                'filter_name': fname,
                'creds': creds if creds else '(default)',
                'allowed': allowed if allowed else '(default)',
                'practically_vulnerable': creds_default_or_true and origins_default_or_wild and not explicitly_safer,
            })

    return findings


def collect_webxmls(base):
    results = []
    for root, dirs, files in os.walk(base):
        # Avoid huge vendor trees that are unlikely to hold deployed descriptors
        if any(skip in root for skip in (os.sep + '.git', os.sep + 'work' + os.sep)):
            continue
        for f in files:
            if f.lower() == 'web.xml':
                results.append(os.path.join(root, f))
    return results


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 tomcat_cve_2018_8014_check.py <TOMCAT_HOME>')
        sys.exit(2)

    base = sys.argv[1]
    if not os.path.isdir(base):
        print('UNKNOWN - base path not found: %s' % base)
        sys.exit(2)

    version = get_tomcat_version(base)
    if not version:
        print('UNKNOWN - could not determine Tomcat version from %s' % base)
        sys.exit(2)

    vt = version_tuple(version)
    if not vt:
        print('UNKNOWN - unparsable Tomcat version: %s' % version)
        sys.exit(2)

    vulnerable_range = (version_tuple('7.0.41') <= vt <= version_tuple('7.0.88'))
    patched_upstream = vt >= version_tuple('7.0.90')

    if patched_upstream:
        print('PATCHED - Tomcat version %s is at or above the first public fixed 7.x release (7.0.90)' % version)
        sys.exit(0)

    if not vulnerable_range:
        print('PATCHED - Tomcat version %s is outside the upstream vulnerable Tomcat 7 range for CVE-2018-8014 (7.0.41-7.0.88)' % version)
        sys.exit(0)

    webxmls = collect_webxmls(base)
    if not webxmls:
        print('UNKNOWN - Tomcat %s is in the vulnerable range, but no web.xml files were found to validate CorsFilter usage' % version)
        sys.exit(2)

    findings = []
    for path in webxmls:
        findings.extend(parse_webxml(path))

    if not findings:
        print('PATCHED - Tomcat %s is in the vulnerable version range, but no mapped org.apache.catalina.filters.CorsFilter was found' % version)
        sys.exit(0)

    bad = [f for f in findings if f['practically_vulnerable']]
    if bad:
        print('VULNERABLE - Tomcat %s is in range and CorsFilter appears to rely on insecure defaults/equivalent settings' % version)
        for f in bad:
            print('  file=%s filter=%s cors.support.credentials=%s cors.allowed.origins=%s' % (f['file'], f['filter_name'], f['creds'], f['allowed']))
        sys.exit(1)

    print('PATCHED - Tomcat %s is in the vulnerable version range, but discovered CorsFilter configs appear explicitly constrained' % version)
    for f in findings:
        print('  file=%s filter=%s cors.support.credentials=%s cors.allowed.origins=%s' % (f['file'], f['filter_name'], f['creds'], f['allowed']))
    sys.exit(0)


if __name__ == '__main__':
    main()