Apache Tomcat 7

#!/usr/bin/env bash
# check_tomcat_cve_2018_11784.sh
# Detect likely exposure to CVE-2018-11784 for Apache Tomcat 7.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

TARGET_PATH="${1:-}"
TOMCAT_VERSION=""
PKG_HINT=""

ver_lt() {
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ]
}

ver_ge() {
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$2" ]
}

find_tomcat_base() {
  local candidates=()
  [ -n "$TARGET_PATH" ] && candidates+=("$TARGET_PATH")
  candidates+=("$CATALINA_HOME" "$CATALINA_BASE" "/opt/tomcat" "/usr/share/tomcat" "/usr/share/tomcat7" "/var/lib/tomcat7" "/opt/rh/jws3/root/usr/share/tomcat")
  for d in "${candidates[@]}"; do
    [ -n "${d:-}" ] || continue
    if [ -f "$d/lib/catalina.jar" ] || [ -f "$d/bin/version.sh" ]; then
      echo "$d"
      return 0
    fi
  done
  return 1
}

get_version_from_manifest() {
  local base="$1"
  local jar="$base/lib/catalina.jar"
  [ -f "$jar" ] || return 1
  if command -v unzip >/dev/null 2>&1; then
    unzip -p "$jar" META-INF/MANIFEST.MF 2>/dev/null | awk -F': ' '/Implementation-Version:/ {print $2; exit}'
    return 0
  elif command -v jar >/dev/null 2>&1; then
    local tmp
    tmp=$(mktemp -d)
    (cd "$tmp" && jar xf "$jar" META-INF/MANIFEST.MF >/dev/null 2>&1 && awk -F': ' '/Implementation-Version:/ {print $2; exit}' META-INF/MANIFEST.MF)
    rm -rf "$tmp"
    return 0
  fi
  return 1
}

check_backports() {
  # Ubuntu trusty fixed backport noted by Ubuntu security tracker
  if command -v dpkg-query >/dev/null 2>&1; then
    local dpkg_ver
    dpkg_ver=$(dpkg-query -W -f='${Version}' tomcat7 2>/dev/null || true)
    if [ -n "$dpkg_ver" ]; then
      PKG_HINT="dpkg tomcat7=$dpkg_ver"
      if command -v dpkg --compare-versions >/dev/null 2>&1; then
        if dpkg --compare-versions "$dpkg_ver" ge "7.0.52-1ubuntu0.16"; then
          echo "PATCHED: recognized Ubuntu/Debian package backport ($PKG_HINT)"
          exit 0
        fi
      fi
    fi
  fi

  # Red Hat JBoss Web Server 3.1 backport noted by RHSA-2019:0131
  if command -v rpm >/dev/null 2>&1; then
    local rpm_ver
    rpm_ver=$(rpm -q --qf '%{VERSION}-%{RELEASE}' tomcat7 2>/dev/null || true)
    if [ -n "$rpm_ver" ] && [ "$rpm_ver" != "package tomcat7 is not installed" ]; then
      PKG_HINT="rpm tomcat7=$rpm_ver"
      if rpmdev-vercmp >/dev/null 2>&1; then
        :
      fi
      if [ "$rpm_ver" = "7.0.70-31.ep7.el7" ] || [ "$rpm_ver" = "7.0.70-31.ep7.el6" ] || [ "$rpm_ver" \
         = "7.0.70-31.ep7.el7.noarch" ] || [ "$rpm_ver" = "7.0.70-31.ep7.el6.noarch" ]; then
        echo "PATCHED: recognized Red Hat JBoss Web Server backport ($PKG_HINT)"
        exit 0
      fi
    fi
  fi
}

main() {
  check_backports

  local base
  base=$(find_tomcat_base || true)
  if [ -z "$base" ]; then
    echo "UNKNOWN: could not locate Tomcat installation or recognized packaged backport"
    exit 2
  fi

  TOMCAT_VERSION=$(get_version_from_manifest "$base" | tr -d '\r' || true)
  if [ -z "$TOMCAT_VERSION" ] && [ -x "$base/bin/version.sh" ]; then
    TOMCAT_VERSION=$(
      CATALINA_HOME="$base" CATALINA_BASE="$base" "$base/bin/version.sh" 2>/dev/null | \
      awk -F': ' '/Server version:/ {print $2}' | sed -E 's/.*Tomcat\/([0-9.]+).*/\1/' | head -n1
    )
  fi

  if [ -z "$TOMCAT_VERSION" ]; then
    echo "UNKNOWN: Tomcat found at $base but version could not be determined"
    exit 2
  fi

  case "$TOMCAT_VERSION" in
    7.*)
      if ver_ge "$TOMCAT_VERSION" "7.0.23" && ver_lt "$TOMCAT_VERSION" "7.0.91"; then
        echo "VULNERABLE: upstream Tomcat version $TOMCAT_VERSION at $base is in 7.0.23-7.0.90"
        exit 1
      elif ver_ge "$TOMCAT_VERSION" "7.0.91"; then
        echo "PATCHED: upstream Tomcat version $TOMCAT_VERSION at $base is >= 7.0.91"
        exit 0
      else
        echo "PATCHED: upstream Tomcat version $TOMCAT_VERSION predates the affected 7.0.23 range"
        exit 0
      fi
      ;;
    8.*|9.*|10.*|11.*)
      echo "UNKNOWN: script is scoped to the Tenable 7.x finding; detected Tomcat $TOMCAT_VERSION at $base"
      exit 2
      ;;
    *)
      echo "UNKNOWN: unrecognized Tomcat version string '$TOMCAT_VERSION' at $base"
      exit 2
      ;;
  esac
}

main