Apache Tomcat 7

#!/usr/bin/env python3
# check_tomcat_cve_2017_5648.py
# Detect likely exposure to CVE-2017-5648 on an Apache Tomcat installation.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import os
import re
import sys
from pathlib import Path

EXIT_PATCHED = 0
EXIT_VULN = 1
EXIT_UNKNOWN = 2


def read_text(path):
    try:
        return Path(path).read_text(encoding='utf-8', errors='ignore')
    except Exception:
        return ''


def parse_version_from_text(text):
    patterns = [
        r'Apache Tomcat Version\s*([0-9]+\.[0-9]+\.[0-9]+)',
        r'server\.info=Apache Tomcat/([0-9]+\.[0-9]+\.[0-9]+)',
        r'Apache Tomcat/([0-9]+\.[0-9]+\.[0-9]+)',
    ]
    for pat in patterns:
        m = re.search(pat, text, re.IGNORECASE)
        if m:
            return m.group(1)
    return None


def version_tuple(v):
    try:
        return tuple(int(x) for x in v.split('.'))
    except Exception:
        return None


def find_version(base):
    candidates = [
        base / 'RELEASE-NOTES',
        base / 'RUNNING.txt',
        base / 'webapps' / 'docs' / 'changelog.html',
        base / 'lib' / 'catalina.jar',  # fallback path indicator only
        base / 'bin' / 'version.sh',
        base / 'bin' / 'version.bat',
        base / 'lib' / 'org' / 'apache' / 'catalina' / 'util' / 'ServerInfo.properties',
    ]

    # Try common text files first.
    for c in candidates:
        if c.exists() and c.is_file():
            text = read_text(c)
            v = parse_version_from_text(text)
            if v:
                return v, str(c)

    # Search broadly but shallowly for ServerInfo.properties or RELEASE-NOTES.
    for root, _, files in os.walk(base):
        if len(Path(root).parts) - len(base.parts) > 5:
            continue
        for name in files:
            if name in ('RELEASE-NOTES', 'RUNNING.txt', 'ServerInfo.properties'):
                p = Path(root) / name
                text = read_text(p)
                v = parse_version_from_text(text)
                if v:
                    return v, str(p)
    return None, None


def security_manager_enabled(base):
    hints = []
    candidates = [
        base / 'bin' / 'catalina.sh',
        base / 'bin' / 'catalina.bat',
        base / 'bin' / 'setenv.sh',
        base / 'bin' / 'setenv.bat',
        base / 'conf' / 'catalina.policy',
        base / 'conf' / 'logging.properties',
    ]

    for c in candidates:
        if c.exists() and c.is_file():
            text = read_text(c)
            if re.search(r'(^|\s)-security(\s|$)', text, re.IGNORECASE):
                hints.append(f'{c}: contains -security')
            if re.search(r'java\.security\.manager', text, re.IGNORECASE):
                hints.append(f'{c}: contains java.security.manager')

    # Lightweight service file scan on Unix-like systems.
    for svc_dir in ('/etc/systemd/system', '/usr/lib/systemd/system', '/etc/init.d'):
        p = Path(svc_dir)
        if p.exists() and p.is_dir():
            for child in p.iterdir():
                if 'tomcat' in child.name.lower() and child.is_file():
                    text = read_text(child)
                    if re.search(r'(^|\s)-security(\s|$)', text, re.IGNORECASE):
                        hints.append(f'{child}: service contains -security')
                    if re.search(r'java\.security\.manager', text, re.IGNORECASE):
                        hints.append(f'{child}: service contains java.security.manager')

    return (len(hints) > 0), hints


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - Usage: python3 check_tomcat_cve_2017_5648.py <TOMCAT_HOME>')
        sys.exit(EXIT_UNKNOWN)

    base = Path(sys.argv[1])
    if not base.exists() or not base.is_dir():
        print(f'UNKNOWN - Path not found or not a directory: {base}')
        sys.exit(EXIT_UNKNOWN)

    version, source = find_version(base)
    if not version:
        print(f'UNKNOWN - Could not determine Tomcat version under {base}')
        sys.exit(EXIT_UNKNOWN)

    vt = version_tuple(version)
    if not vt:
        print(f'UNKNOWN - Parsed unusable version string: {version}')
        sys.exit(EXIT_UNKNOWN)

    fixed = (7, 0, 76)

    # Only assess Tomcat 7 here; plugin 121120 is specifically Tomcat 7.0.0 < 7.0.76.
    if vt[0] != 7:
        print(f'PATCHED - Detected Tomcat {version} from {source}; plugin 121120 applies to Tomcat 7 only')
        sys.exit(EXIT_PATCHED)

    if vt >= fixed:
        print(f'PATCHED - Detected Tomcat {version} from {source}; fixed in 7.0.76+')
        sys.exit(EXIT_PATCHED)

    sm_enabled, hints = security_manager_enabled(base)
    if sm_enabled:
        hint_text = '; '.join(hints[:5])
        print(f'VULNERABLE - Detected Tomcat {version} (< 7.0.76) and SecurityManager evidence: {hint_text}')
        sys.exit(EXIT_VULN)

    print(f'UNKNOWN - Detected Tomcat {version} (< 7.0.76) but found no clear SecurityManager evidence. Manually verify runtime startup flags (-security / java.security.manager).')
    sys.exit(EXIT_UNKNOWN)


if __name__ == '__main__':
    main()