Apache Tomcat 7

#!/usr/bin/env python3
# check_tomcat_83526.py
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import os
import re
import sys
import zipfile
import subprocess
import platform
from pathlib import Path

PATCHED = 0
VULNERABLE = 1
UNKNOWN = 2


def read_text(path):
    try:
        return Path(path).read_text(encoding='utf-8', errors='ignore')
    except Exception:
        return ''


def parse_version_tuple(v):
    nums = re.findall(r'\d+', v or '')
    return tuple(int(x) for x in nums[:4]) if nums else tuple()


def version_lt(a, b):
    ta = parse_version_tuple(a)
    tb = parse_version_tuple(b)
    if not ta or not tb:
        return None
    la = list(ta) + [0] * (len(tb) - len(ta))
    lb = list(tb) + [0] * (len(ta) - len(tb))
    return tuple(la) < tuple(lb)


def get_tomcat_version(tomcat_home):
    candidates = [
        Path(tomcat_home) / 'lib' / 'catalina.jar',
        Path(tomcat_home) / 'server' / 'lib' / 'catalina.jar',
    ]
    for jar in candidates:
        if jar.exists():
            try:
                with zipfile.ZipFile(jar, 'r') as zf:
                    data = zf.read('META-INF/MANIFEST.MF').decode('utf-8', errors='ignore')
                    m = re.search(r'Implementation-Version:\s*([^\r\n]+)', data)
                    if m:
                        return m.group(1).strip()
            except Exception:
                pass
    for txt in ['RELEASE-NOTES', 'RUNNING.txt', 'NOTICE']:
        data = read_text(Path(tomcat_home) / txt)
        m = re.search(r'Apache Tomcat(?:/|\s+)Version\s*[:\-]?\s*([0-9][0-9.]+)', data, re.I)
        if m:
            return m.group(1)
        m = re.search(r'Apache Tomcat/?\s*([0-9][0-9.]+)', data, re.I)
        if m:
            return m.group(1)
    return None


def get_server_xml(tomcat_home):
    return read_text(Path(tomcat_home) / 'conf' / 'server.xml')


def apr_indicators(server_xml):
    indicators = []
    pats = [
        r'AprLifecycleListener',
        r'Http11AprProtocol',
        r'AjpAprProtocol',
        r'SSLEngine\s*=\s*"on"',
        r'certificateFile\s*=\s*"',
        r'certificateKeyFile\s*=\s*"',
    ]
    for p in pats:
        if re.search(p, server_xml, re.I):
            indicators.append(p)
    return indicators


def find_native_libs(tomcat_home):
    names = {'tcnative-1.dll', 'libtcnative-1.so', 'libtcnative-1.jnilib', 'libtcnative-1.dylib'}
    found = []
    for root, dirs, files in os.walk(tomcat_home):
        for f in files:
            if f.lower() in {n.lower() for n in names}:
                found.append(str(Path(root) / f))
    return found


def get_openssl_version():
    try:
        p = subprocess.run(['openssl', 'version'], capture_output=True, text=True, timeout=5)
        if p.returncode == 0:
            out = (p.stdout or p.stderr).strip()
            m = re.search(r'OpenSSL\s+([0-9a-zA-Z.]+)', out)
            return m.group(1) if m else out
    except Exception:
        pass
    return None


def openssl_is_vulnerable(v):
    if not v:
        return None
    if re.match(r'^0\.9\.8', v):
        return version_lt(v, '0.9.8zd')
    if re.match(r'^1\.0\.0', v):
        return version_lt(v, '1.0.0p')
    if re.match(r'^1\.0\.1', v):
        return version_lt(v, '1.0.1k')
    return False


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: check_tomcat_83526.py <TOMCAT_HOME>')
        sys.exit(UNKNOWN)

    tomcat_home = sys.argv[1]
    if not Path(tomcat_home).exists():
        print('UNKNOWN - TOMCAT_HOME not found')
        sys.exit(UNKNOWN)

    tomcat_ver = get_tomcat_version(tomcat_home)
    server_xml = get_server_xml(tomcat_home)
    apr_hits = apr_indicators(server_xml)
    native_libs = find_native_libs(tomcat_home)
    openssl_ver = get_openssl_version()
    system_name = platform.system().lower()

    apr_in_use_likely = bool(apr_hits or native_libs)

    details = {
        'tomcat_version': tomcat_ver,
        'apr_indicators': apr_hits,
        'native_libs': native_libs,
        'openssl_version': openssl_ver,
        'platform': system_name,
    }

    # If APR/native is not present, this specific OpenSSL-driven finding is usually not real.
    if not apr_in_use_likely:
        print(f"PATCHED - no APR/native indicators found; likely JSSE-backed Tomcat. Details={details}")
        sys.exit(PATCHED)

    # If APR/native is present, inspect OpenSSL version when possible.
    if openssl_ver:
        vuln = openssl_is_vulnerable(openssl_ver)
        if vuln is True:
            print(f"VULNERABLE - APR/native present and OpenSSL appears vulnerable ({openssl_ver}). Details={details}")
            sys.exit(VULNERABLE)
        if vuln is False:
            print(f"PATCHED - APR/native present but OpenSSL appears fixed ({openssl_ver}). Details={details}")
            sys.exit(PATCHED)

    # Windows bundles before Tomcat 7.0.60 are especially suspicious because old tcnative binaries shipped with older OpenSSL.
    if system_name.startswith('win') and tomcat_ver:
        older = version_lt(tomcat_ver, '7.0.60')
        if older is True and native_libs:
            print(f"VULNERABLE - Windows Tomcat < 7.0.60 with bundled/native tcnative present; verify OpenSSL immediately. Details={details}")
            sys.exit(VULNERABLE)
        if older is False:
            print(f"PATCHED - Tomcat >= 7.0.60 and native present, but OpenSSL version could not be read. Details={details}")
            sys.exit(PATCHED)

    print(f"UNKNOWN - APR/native indicators found but OpenSSL version could not be confirmed. Details={details}")
    sys.exit(UNKNOWN)


if __name__ == '__main__':
    main()