Apache Tomcat 9.0.0.M1 < 9.0.68

#!/usr/bin/env python3
# check_tomcat_cve_2022_42252.py
# Detects Tomcat 9 exposure to CVE-2022-42252 based on version + connector config.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import re
import sys
import zipfile
from pathlib import Path

AFFECTED_FIXED = (9, 0, 68)


def parse_version_string(s):
    if not s:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)', s)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def find_tomcat_version(base):
    # 1) RELEASE-NOTES / RUNNING.txt
    for rel in ['RELEASE-NOTES', 'RUNNING.txt', 'RELEASE-NOTES.txt']:
        p = base / rel
        if p.is_file():
            try:
                txt = p.read_text(errors='ignore')
                v = parse_version_string(txt)
                if v:
                    return v, f'{p}'
            except Exception:
                pass

    # 2) catalina.jar -> ServerInfo.properties
    jar = base / 'lib' / 'catalina.jar'
    if jar.is_file():
        try:
            with zipfile.ZipFile(jar, 'r') as zf:
                for name in [
                    'org/apache/catalina/util/ServerInfo.properties',
                    'org/apache/catalina/util/ServerInfo.properties.default'
                ]:
                    if name in zf.namelist():
                        data = zf.read(name).decode('utf-8', errors='ignore')
                        for line in data.splitlines():
                            if line.strip().startswith('server.number='):
                                v = parse_version_string(line.split('=', 1)[1].strip())
                                if v:
                                    return v, f'{jar}!{name}'
        except Exception:
            pass

    return None, None


def is_tomcat9(v):
    return v is not None and len(v) == 3 and v[0] == 9


def scan_reject_illegal_header_false(base):
    hits = []
    conf = base / 'conf'
    if not conf.exists():
        return hits

    for p in conf.rglob('*.xml'):
        try:
            txt = p.read_text(errors='ignore')
        except Exception:
            continue
        if re.search(r'rejectIllegalHeader\s*=\s*["\']false["\']', txt, re.IGNORECASE):
            hits.append(str(p))
    return hits


def main():
    arg = None
    if len(sys.argv) > 1:
        arg = sys.argv[1]
    else:
        arg = os.environ.get('CATALINA_BASE') or os.environ.get('CATALINA_HOME') or '.'

    base = Path(arg).expanduser().resolve()
    if not base.exists():
        print(f'UNKNOWN - Path not found: {base}')
        sys.exit(2)

    version, source = find_tomcat_version(base)
    if version is None:
        print(f'UNKNOWN - Could not determine Tomcat version under {base}')
        sys.exit(2)

    if not is_tomcat9(version):
        print(f'UNKNOWN - Detected Tomcat version {version[0]}.{version[1]}.{version[2]} (script is scoped to Tomcat 9 / plugin 166906)')
        sys.exit(2)

    hits = scan_reject_illegal_header_false(base)
    ver_str = f'{version[0]}.{version[1]}.{version[2]}'

    if version >= AFFECTED_FIXED:
        print(f'PATCHED - Tomcat {ver_str} >= 9.0.68 (source: {source})')
        sys.exit(0)

    # For Tomcat 9, Apache states the vulnerable setting is non-default.
    if hits:
        print(f'VULNERABLE - Tomcat {ver_str} < 9.0.68 and rejectIllegalHeader="false" found in: {", ".join(hits)}')
        sys.exit(1)
    else:
        print(f'PATCHED - Tomcat {ver_str} < 9.0.68 but no rejectIllegalHeader="false" found under {base}/conf; Tomcat 9 is not vulnerable by default')
        sys.exit(0)


if __name__ == '__main__':
    main()