#!/usr/bin/env bash # ============================================================================== # SYNOPSIS # Mitigation script for CVE-2025-55752. # # DESCRIPTION # This script mitigates CVE-2025-55752 by disabling RewriteValve and forcing # readonly=true in Apache Tomcat configurations. The vulnerability allows # path traversal through rewritten URLs, potentially leading to unauthorized # access to protected directories (/WEB-INF/, /META-INF/) and remote code # execution if PUT requests are enabled. # # AFFECTED VERSIONS: # - Apache Tomcat 11.0.0-M1 through 11.0.10 # - Apache Tomcat 10.1.0-M1 through 10.1.44 # - Apache Tomcat 9.0.0.M11 through 9.0.108 # - Apache Tomcat 8.5.6 through 8.5.100 (EOL) # # MITIGATION ACTIONS: # 1. Disables RewriteValve by commenting it out in all configuration files # (server.xml and context.xml files) # 2. Forces readonly=true in web.xml to disable PUT requests # 3. Creates timestamped backups of all modified configuration files # # VARIABLES TO DEFINE: # CATALINA_HOME # optional - if set, uses this path for Tomcat installation # # otherwise auto-detects from common installation paths # # WARNINGS: # - REQUIRES ROOT/SUDO: Script must be executed with elevated privileges # - MODIFIES FILES: Changes Tomcat configuration files (backups created) # - REQUIRES RESTART: Tomcat service must be restarted after mitigation # - SERVICE DISRUPTION: RewriteValve functionality will be disabled # # EXECUTION # chmod +x mitigate_cve_2025_55752.sh # sudo ./mitigate_cve_2025_55752.sh # # Alternative execution: # sudo bash mitigate_cve_2025_55752.sh # # After execution, restart Tomcat: # sudo systemctl restart tomcat # # or # sudo $CATALINA_HOME/bin/shutdown.sh && sudo $CATALINA_HOME/bin/startup.sh # # DISCLAIMER # VICARIUS STRONGLY RECOMMENDS RUNNING THESE SCRIPTS IN A TEST LAB ENVIRONMENT # BEFORE DEPLOYING THEM TO PRODUCTION. USE AT YOUR OWN DISCRETION ONLY AFTER # CAREFULLY ANALYZING THE CODE. # # AUTHOR # This script has been made by Vicarius Research Team # # VERSION # 1.0 # ============================================================================== # Logging helpers info(){ echo "[i] $*"; } good(){ echo "[+] $*"; } warn(){ echo "[!] $*"; } bad(){ echo "[-] $*"; } # Check if running as root if [ "$EUID" -ne 0 ]; then bad "This script must be run as root or with sudo" exit 1 fi echo "==========================================" echo " CVE-2025-55752 Mitigation - Apache Tomcat" echo "==========================================" echo "" # Find Tomcat installation CATALINA_HOME="" TOMCAT_PATHS=( "/usr/share/tomcat" "/usr/share/tomcat9" "/usr/share/tomcat10" "/usr/share/tomcat11" "/opt/tomcat" "/var/lib/tomcat" "/var/lib/tomcat9" "/var/lib/tomcat10" "/var/lib/tomcat11" "$CATALINA_HOME" ) # Search for Tomcat for path in "${TOMCAT_PATHS[@]}"; do if [ -d "$path" ] && [ -f "$path/lib/catalina.jar" ]; then CATALINA_HOME="$path" break fi done # If not found, try to locate using which if [ -z "$CATALINA_HOME" ]; then TOMCAT_BIN=$(which catalina.sh 2>/dev/null) if [ -n "$TOMCAT_BIN" ]; then CATALINA_HOME=$(dirname "$(dirname "$TOMCAT_BIN")") fi fi if [ -z "$CATALINA_HOME" ] || [ ! -d "$CATALINA_HOME" ]; then bad "Could not find Apache Tomcat installation" exit 1 fi info "Tomcat found at: $CATALINA_HOME" echo "" # Create backup directory BACKUP_DIR="$CATALINA_HOME/conf/backups_cve_2025_55752" mkdir -p "$BACKUP_DIR" TIMESTAMP=$(date +%Y%m%d_%H%M%S) info "Backups will be saved to: $BACKUP_DIR" echo "" # Tracking variables CHANGES_MADE=0 REWRITE_DISABLED=0 READONLY_FORCED=0 # ========================== # STEP 1: Disable RewriteValve # ========================== echo "----------------------------------------" info "STEP 1: Disabling RewriteValve" echo "----------------------------------------" echo "" SERVER_XML="$CATALINA_HOME/conf/server.xml" # Process server.xml if [ -f "$SERVER_XML" ]; then if grep -q "org.apache.catalina.valves.rewrite.RewriteValve" "$SERVER_XML" 2>/dev/null; then # Check if already commented out if ! grep "org.apache.catalina.valves.rewrite.RewriteValve" "$SERVER_XML" | grep -q "^[[:space:]]*/' "$SERVER_XML" # Alternative verification for multi-line valves awk ' // { print $0 " -->" in_valve = 0 next } in_valve && /<\/Valve>/ { print $0 " -->" in_valve = 0 next } in_valve { print $0 next } { print } ' "$SERVER_XML.bak" > "$SERVER_XML.tmp" && mv "$SERVER_XML.tmp" "$SERVER_XML" rm -f "$SERVER_XML.bak" good "RewriteValve disabled in server.xml" REWRITE_DISABLED=1 CHANGES_MADE=1 echo "" else info "RewriteValve already commented out in server.xml" echo "" fi else info "RewriteValve not found in server.xml" echo "" fi else warn "Could not find $SERVER_XML" echo "" fi # Process application context.xml files if [ -d "$CATALINA_HOME/webapps" ]; then while IFS= read -r context_xml; do if grep -q "org.apache.catalina.valves.rewrite.RewriteValve" "$context_xml" 2>/dev/null; then if ! grep "org.apache.catalina.valves.rewrite.RewriteValve" "$context_xml" | grep -q "^[[:space:]]*" in_valve = 0 next } in_valve && /<\/Valve>/ { print $0 " -->" in_valve = 0 next } in_valve { print $0 next } { print } ' "$context_xml" > "$context_xml.tmp" && mv "$context_xml.tmp" "$context_xml" good "RewriteValve disabled in $context_xml" REWRITE_DISABLED=1 CHANGES_MADE=1 echo "" fi fi done < <(find "$CATALINA_HOME/webapps" -name "context.xml" 2>/dev/null) fi if [ $REWRITE_DISABLED -eq 1 ]; then good "RewriteValve has been successfully disabled" else info "No active RewriteValve instances found" fi echo "" # ========================== # STEP 2: Force readonly=true # ========================== echo "----------------------------------------" info "STEP 2: Forcing readonly=true in web.xml" echo "----------------------------------------" echo "" WEB_XML="$CATALINA_HOME/conf/web.xml" if [ -f "$WEB_XML" ]; then # Check if readonly exists and its value READONLY_VALUE=$(grep -A 10 "org.apache.catalina.servlets.DefaultServlet" "$WEB_XML" 2>/dev/null | grep -A 1 "readonly" | grep "" | sed 's/.*$.*$<\/param-value>.*/\1/' | tr -d ' ') if [ "$READONLY_VALUE" = "false" ]; then info "readonly=false detected, changing to true" # Create backup cp "$WEB_XML" "$BACKUP_DIR/web.xml.$TIMESTAMP" good "Backup created: $BACKUP_DIR/web.xml.$TIMESTAMP" # Change false to true sed -i "/readonly<\/param-name>/,/<\/init-param>/s/false<\/param-value>/true<\/param-value>/" "$WEB_XML" good "readonly changed to true in web.xml" READONLY_FORCED=1 CHANGES_MADE=1 echo "" elif [ "$READONLY_VALUE" = "true" ]; then info "readonly is already set to true" echo "" elif [ -z "$READONLY_VALUE" ]; then info "readonly parameter not found, adding it explicitly" # Create backup cp "$WEB_XML" "$BACKUP_DIR/web.xml.$TIMESTAMP" good "Backup created: $BACKUP_DIR/web.xml.$TIMESTAMP" # Find DefaultServlet and insert parameter awk ' /org.apache.catalina.servlets.DefaultServlet<\/servlet-class>/ { found = 1 print $0 next } found && /<\/servlet>/ { print " " print " readonly" print " true" print " " found = 0 } { print } ' "$WEB_XML" > "$WEB_XML.tmp" && mv "$WEB_XML.tmp" "$WEB_XML" good "readonly=true parameter added to web.xml" READONLY_FORCED=1 CHANGES_MADE=1 echo "" fi else warn "Could not find $WEB_XML" echo "" fi # ========================== # FINAL SUMMARY # ========================== echo "==========================================" info "Mitigation Summary" echo "==========================================" echo "" if [ $CHANGES_MADE -eq 1 ]; then good "Mitigation applied successfully" echo "" echo "Changes made:" if [ $REWRITE_DISABLED -eq 1 ]; then echo " [✓] RewriteValve disabled" fi if [ $READONLY_FORCED -eq 1 ]; then echo " [✓] readonly=true forced in web.xml" fi echo "" warn "IMPORTANT: You must restart Apache Tomcat to apply the changes" echo "" echo "To restart Tomcat, run:" echo " systemctl restart tomcat" echo " or" echo " $CATALINA_HOME/bin/shutdown.sh && $CATALINA_HOME/bin/startup.sh" echo "" info "Configuration backups are stored in: $BACKUP_DIR" else info "No changes were made, system is already mitigated" fi echo "" echo "==========================================" good "Mitigation process completed" echo "=========================================="

Description