#!/bin/bash # Tomcat installation path TOMCAT_DIR="/path/to/tomcat" WEB_XML="$TOMCAT_DIR/conf/web.xml" CONTEXT_XML="$TOMCAT_DIR/conf/context.xml" echo "Disabling write access in the default servlet..." # Check if web.xml exists before modifying it if [ -f "$WEB_XML" ]; then if grep -q "readonly" "$WEB_XML"; then # If the configuration already exists, update it sed -i '/readonly<\/param-name>/,//s/.*<\/param-value>/true<\/param-value>/' "$WEB_XML" echo "Mitigation applied in $WEB_XML (readonly=true)" else # If it doesn't exist, add it sed -i '/<\/web-app>/i \ \ default \ \ readonly \ true \ \ ' "$WEB_XML" echo "Configuration added in $WEB_XML (readonly=true)" fi else echo "ERROR: The file $WEB_XML was not found. Cannot apply the mitigation." exit 1 fi echo "Disabling support for partial PUT requests..." # Check if web.xml exists before modifying it if [ -f "$WEB_XML" ]; then if grep -q "allowPartialPut" "$WEB_XML"; then # If the configuration already exists, update it sed -i '/allowPartialPut<\/param-name>/,//s/.*<\/param-value>/false<\/param-value>/' "$WEB_XML" echo "Mitigation applied in $WEB_XML (allowPartiallyPut=false)" else # If it doesn't exist, add it sed -i '/<\/web-app>/i \ \ default \ \ allowPartiallyPut \ false \ \ ' "$WEB_XML" echo "Configuration added in $WEB_XML (allowPartiallyPut=false)" fi else echo "ERROR: The file $WEB_XML was not found. Cannot apply the mitigation." exit 1 fi # Function to update context.xml update_context_xml() { if [ -f "$CONTEXT_XML" ]; then if grep -q 'className="org.apache.catalina.session.PersistentManager"' "$CONTEXT_XML"; then # If the configuration already exists, update it sed -i 's||' "$CONTEXT_XML" echo "Mitigation applied in $CONTEXT_XML (saveOnRestart=false)" else # If it doesn't exist, add it sed -i '/<\/Context>/i \ \n' "$CONTEXT_XML" echo "Configuration added in $CONTEXT_XML (saveOnRestart=false)" fi else echo "ERROR: The file $CONTEXT_XML was not found. Cannot apply the mitigation." exit 1 fi } echo "Disabling saveOnRestart in context.xml..." update_context_xml echo "Restarting Apache Tomcat..." # Check if Tomcat is running before attempting to stop it if pgrep -f "org.apache.catalina.startup.Bootstrap" > /dev/null; then "$TOMCAT_DIR/bin/shutdown.sh" sleep 5 else echo "WARNING: Tomcat was not running before applying the mitigation." fi # Start Tomcat "$TOMCAT_DIR/bin/startup.sh" # Check if Tomcat restarted successfully if pgrep -f "org.apache.catalina.startup.Bootstrap" > /dev/null; then echo "Apache Tomcat restarted successfully." else echo "ERROR: Could not restart Apache Tomcat." exit 1 fi echo "Mitigation completed. Apache Tomcat restarted."

Description