#!/usr/bin/env bash # ============================================================================== # SYNOPSIS # Detects whether the local Apache Tomcat installation is vulnerable to # CVE-2025-55752 and reports if the readonly mitigation is present in web.xml. # # DESCRIPTION # This script inspects the Tomcat version from catalina.jar's manifest and # compares it against known vulnerable ranges. If vulnerable, it checks the # servlet's 'readonly' parameter in conf/web.xml to determine if # the temporary mitigation (readonly=true) is present. # # VARIABLES TO DEFINE: # TOMCAT_HOME (optional) - Base directory of Tomcat. Defaults to /opt/tomcat. # Example: TOMCAT_HOME="/var/lib/tomcat9" # # REQUIREMENTS: # - Read access to: $TOMCAT_HOME/lib/catalina.jar and $TOMCAT_HOME/conf/web.xml # - Utilities: unzip, grep, awk, tr # # WARNINGS: # - Read-only check depends on expected web.xml structure for the servlet. # - Always validate results in a test environment before acting in production. # # EXECUTION # Make executable and run: # chmod +x ./tomcat_cve_2025_24813_detect.sh && ./tomcat_cve_2025_24813_detect.sh # Or run with bash: # bash ./tomcat_cve_2025_24813_detect.sh # Override TOMCAT_HOME: # TOMCAT_HOME="/var/lib/tomcat9" bash ./tomcat_cve_2025_24813_detect.sh # # DISCLAIMER # VICARIUS STRONGLY RECOMMENDS RUNNING THESE SCRIPTS IN A TEST LAB ENVIRONMENT # BEFORE DEPLOYING THEM TO PRODUCTION. USE AT YOUR OWN DISCRETION ONLY AFTER # CAREFULLY ANALYZING THE CODE. # # AUTHOR # This script has been made by Vicarius Research Team # # VERSION # 1.0 # ============================================================================== # Define Tomcat paths TOMCAT_HOME="${TOMCAT_HOME:-/opt/tomcat}" WEB_XML="$TOMCAT_HOME/conf/web.xml" CATALINA_JAR="$TOMCAT_HOME/lib/catalina.jar" # Ensure the catalina.jar file exists to extract version if [ ! -f "$CATALINA_JAR" ]; then echo "[-] Tomcat version file not found at: $CATALINA_JAR" exit 1 fi # Extract the version string from manifest version=$(unzip -p "$CATALINA_JAR" META-INF/MANIFEST.MF 2>/dev/null | grep -E '^(Specification-Version|Implementation-Version):' | awk '{print $2}' | tr -d '\r') if [ -z "$version" ]; then echo "[-] Could not determine Tomcat version." exit 1 else echo "[+] Detected Tomcat version: $version" fi # Parse version components IFS='.' read -r major minor patch <<< "$version" major="${major:-0}" minor="${minor:-0}" patch="${patch:-0}" vulnerable=false # Check if version is in a vulnerable range # (Example ranges; adjust as official advisories update) if [[ "$major" == "9" && "$patch" -lt 99 ]]; then vulnerable=true elif [[ "$major" == "10" && "$minor" == "1" && "$patch" -lt 35 ]]; then vulnerable=true elif [[ "$major" == "11" && "$patch" -lt 3 ]]; then vulnerable=true fi # If vulnerable, check mitigation status in web.xml if $vulnerable; then echo "[-] Version is VULNERABLE to CVE-2025-24813" if [ -f "$WEB_XML" ]; then readonly_status=$(grep -A6 'default' "$WEB_XML" \ | grep -A1 'readonly' \ | grep -E '\s*true\s*' -i) if [ -n "$readonly_status" ]; then echo "[+] readonly = true (temporary mitigation present)" else echo "[-] readonly = false or missing (no mitigation detected)" fi else echo "[!] $WEB_XML not found; cannot verify readonly mitigation." fi else echo "[+] Version is NOT vulnerable to CVE-2025-24813" fi

Description