Apache Tomcat 9

#!/usr/bin/env python3
"""
verify_cve_2023_28708.py
Checks whether a Tomcat 9 installation is vulnerable to CVE-2023-28708.

Logic:
- If Tomcat version is 9.0.72 or later => PATCHED
- If Tomcat version is 9.0.0-M1 through 9.0.71 and RemoteIpFilter is found in common config/app files => VULNERABLE
- If version is vulnerable but RemoteIpFilter is not found => UNKNOWN
- If version cannot be determined => UNKNOWN

Exit codes:
0 = PATCHED
1 = VULNERABLE
2 = UNKNOWN
"""

import os
import re
import sys
import zipfile
from pathlib import Path

REMOTE_IP_PATTERNS = [
    "RemoteIpFilter",
    "org.apache.catalina.filters.RemoteIpFilter",
]


def read_text(path):
    try:
        return Path(path).read_text(errors="ignore")
    except Exception:
        return None


def get_version_from_release_notes(base):
    for rel in [base / "RELEASE-NOTES", base / "RUNNING.txt", base / "RELEASE-NOTES.txt"]:
        txt = read_text(rel)
        if not txt:
            continue
        m = re.search(r"Apache Tomcat Version\s+([0-9]+\.[0-9]+\.[0-9]+(?:[-.][A-Za-z0-9]+)?)", txt)
        if m:
            return m.group(1)
        m = re.search(r"Apache Tomcat/([0-9]+\.[0-9]+\.[0-9]+(?:[-.][A-Za-z0-9]+)?)", txt)
        if m:
            return m.group(1)
    return None


def get_version_from_manifest(base):
    jar_candidates = [
        base / "lib" / "catalina.jar",
        base / "lib" / "tomcat-catalina.jar",
    ]
    for jar in jar_candidates:
        if not jar.exists():
            continue
        try:
            with zipfile.ZipFile(jar, "r") as zf:
                for name in ["META-INF/MANIFEST.MF", "org/apache/catalina/util/ServerInfo.properties"]:
                    try:
                        data = zf.read(name).decode("utf-8", errors="ignore")
                    except Exception:
                        continue
                    m = re.search(r"(?:Implementation-Version|Server number):\s*([0-9]+\.[0-9]+\.[0-9]+(?:[-.][A-Za-z0-9]+)?)", data)
                    if m:
                        return m.group(1)
        except Exception:
            pass
    return None


def normalize_version(v):
    # Supports 9.0.71 and 9.0.0-M1 style values.
    # milestone/build suffixes sort below final releases.
    if not v:
        return None
    m = re.match(r"^(\d+)\.(\d+)\.(\d+)(?:[-.]?([A-Za-z]+)(\d+)?)?$", v)
    if not m:
        return None
    major, minor, patch = int(m.group(1)), int(m.group(2)), int(m.group(3))
    label = (m.group(4) or "").upper()
    label_num = int(m.group(5) or 0)
    order = {"M": -3, "MILESTONE": -3, "RC": -2, "B": -1, "": 0}
    return (major, minor, patch, order.get(label, 0), label_num)


def version_lt(a, b):
    na, nb = normalize_version(a), normalize_version(b)
    if na is None or nb is None:
        return None
    return na < nb


def version_is_tomcat9(v):
    nv = normalize_version(v)
    return nv is not None and nv[0] == 9


def find_remote_ip_filter(base):
    candidates = []
    conf = base / "conf"
    if conf.exists():
        candidates.extend(conf.rglob("*.xml"))
    webapps = base / "webapps"
    if webapps.exists():
        candidates.extend(webapps.rglob("WEB-INF/web.xml"))

    hits = []
    for path in candidates:
        try:
            txt = path.read_text(errors="ignore")
        except Exception:
            continue
        if any(p in txt for p in REMOTE_IP_PATTERNS):
            hits.append(str(path))
    return hits


def main():
    if len(sys.argv) != 2:
        print("UNKNOWN - usage: python3 verify_cve_2023_28708.py /path/to/tomcat")
        sys.exit(2)

    base = Path(sys.argv[1]).resolve()
    if not base.exists() or not base.is_dir():
        print(f"UNKNOWN - Tomcat base not found: {base}")
        sys.exit(2)

    version = get_version_from_release_notes(base) or get_version_from_manifest(base)
    if not version:
        print("UNKNOWN - could not determine Tomcat version")
        sys.exit(2)

    if not version_is_tomcat9(version):
        print(f"UNKNOWN - detected Tomcat version {version}; this script only assesses the Tomcat 9 plugin scope")
        sys.exit(2)

    cmp_res = version_lt(version, "9.0.72")
    if cmp_res is None:
        print(f"UNKNOWN - could not compare version {version} to 9.0.72")
        sys.exit(2)

    if not cmp_res:
        print(f"PATCHED - Tomcat {version} is not in the vulnerable 9.x range for CVE-2023-28708")
        sys.exit(0)

    hits = find_remote_ip_filter(base)
    if hits:
        print(f"VULNERABLE - Tomcat {version} is < 9.0.72 and RemoteIpFilter was found in: {', '.join(hits[:10])}")
        sys.exit(1)

    print(f"UNKNOWN - Tomcat {version} is < 9.0.72 but RemoteIpFilter was not found in common configs; manual review of proxy/cookie behavior is required")
    sys.exit(2)


if __name__ == "__main__":
    main()