#!/bin/bash # ============================================================================ # SYNOPSIS # CVE-2026-34486 - Apache Tomcat Tribes EncryptInterceptor Fail-Open Bypass # Remediation Script (Linux) # # DESCRIPTION # This script implements non-patch workarounds to mitigate CVE-2026-34486 on # Linux systems running vulnerable Apache Tomcat versions (9.0.116, 10.1.53, # 11.0.20) where immediate patching is not feasible. # # The script applies the following layered mitigations: # 1. Creates iptables/nftables rules to block inbound TCP/4000 (Tribes # receiver) from all sources except explicitly whitelisted cluster peers. # 2. Comments out the element in server.xml to disable Tribes # clustering entirely (when no peers are specified). # 3. Scans the Tomcat classpath for known-vulnerable deserialization gadget # libraries (commons-collections 3.x, commons-beanutils) and renames # them to neutralize the attack surface. # 4. Optionally configures JEP 290 deserialization filtering as an # additional defense layer. # # REQUIREMENTS: # - Bash: 4.0+ # - OS: Linux (RHEL/CentOS/Fedora, Ubuntu/Debian, SLES, Amazon Linux) # - Tools: iptables or nftables, grep, sed, find # - Privileges: Root required # # WARNINGS: # - Blocking TCP/4000 will prevent Tribes cluster communication from # non-whitelisted peers. # - Disabling clustering will stop session replication between nodes. # - Renaming gadget libraries may break applications that depend on them. # - ALWAYS test in a lab environment before applying to production. # # NOTES # VERSION: 1.0 # CHANGELOG: # - 1.0 (2026-05-18): Initial release. # # DISCLAIMER: VICARIUS STRONGLY RECOMMENDS RUNNING THESE SCRIPTS IN A TEST # LAB ENVIRONMENT BEFORE DEPLOYING THEM IN PRODUCTION. THE SCRIPTS ARE # PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USE AT # YOUR OWN RISK. VICARIUS SHALL NOT BE LIABLE FOR ANY DAMAGES ARISING FROM # THE USE OF THESE SCRIPTS. # # AUTHOR # This script has been made by Vicarius Research Team # # VERSION # 1.0 # ============================================================================ set -uo pipefail # ============================================================================ # Configuration # ============================================================================ CVE_ID="CVE-2026-34486" TRIBES_PORT=4000 IPTABLES_CHAIN="CVE_2026_34486_TRIBES" # Define trusted cluster peer IPs here. If empty, ALL inbound to port 4000 is blocked. # Example: TRUSTED_CLUSTER_PEERS=("10.0.1.10" "10.0.1.11") TRUSTED_CLUSTER_PEERS=() # Known-vulnerable deserialization gadget library patterns DANGEROUS_LIB_PATTERNS=( "commons-collections-3.*.jar" "commons-collections4-4.[0-3]*.jar" "commons-beanutils-1.[0-8]*.jar" ) # ============================================================================ # Write-Status Function # ============================================================================ write_status() { local message="$1" local type="$2" case "$type" in Info) tag="[Info]" ;; Success) tag="[Success]" ;; Warning) tag="[Warning]" ;; Check) tag="[Check]" ;; Error) tag="[Error]" ;; *) tag="[Info]" ;; esac echo "$tag $message" } # ============================================================================ # Root Check # ============================================================================ if [[ $EUID -ne 0 ]]; then write_status "Root privileges required. Please run with sudo or as root." "Error" echo "RESULT=$CVE_ID|MITIGATED|FALSE" exit 1 fi write_status "Starting remediation for $CVE_ID - Apache Tomcat Tribes EncryptInterceptor Bypass." "Info" # ============================================================================ # Main remediation block with error handling # ============================================================================ { # ======================================================================== # MITIGATION 1: Firewall Rules for Tribes Receiver Port (TCP/4000) # ======================================================================== write_status "------------------------------------------------------" "Info" write_status "MITIGATION 1: Firewall hardening for Tribes port TCP/$TRIBES_PORT." "Check" firewall_applied=false # Detect available firewall tool if command -v iptables &>/dev/null; then write_status "Using iptables for firewall rules." "Info" # Flush existing chain if it exists if iptables -L "$IPTABLES_CHAIN" -n &>/dev/null; then # Remove references from INPUT chain while iptables -D INPUT -j "$IPTABLES_CHAIN" 2>/dev/null; do :; done iptables -F "$IPTABLES_CHAIN" 2>/dev/null || true iptables -X "$IPTABLES_CHAIN" 2>/dev/null || true write_status "Cleared pre-existing iptables chain: $IPTABLES_CHAIN" "Info" fi # Create dedicated chain iptables -N "$IPTABLES_CHAIN" if [[ ${#TRUSTED_CLUSTER_PEERS[@]} -gt 0 ]]; then # Allow trusted peers first for peer in "${TRUSTED_CLUSTER_PEERS[@]}"; do iptables -A "$IPTABLES_CHAIN" -p tcp --dport "$TRIBES_PORT" -s "$peer" -j ACCEPT write_status "Created ALLOW rule for trusted cluster peer: $peer" "Success" done fi # Drop everything else to port 4000 iptables -A "$IPTABLES_CHAIN" -p tcp --dport "$TRIBES_PORT" -j DROP # Insert chain reference into INPUT iptables -I INPUT 1 -p tcp --dport "$TRIBES_PORT" -j "$IPTABLES_CHAIN" if [[ ${#TRUSTED_CLUSTER_PEERS[@]} -gt 0 ]]; then write_status "Created iptables rules: ALLOW ${#TRUSTED_CLUSTER_PEERS[@]} peer(s), DROP all others on TCP/$TRIBES_PORT." "Success" else write_status "Created iptables rule: DROP ALL inbound TCP/$TRIBES_PORT." "Success" fi # Persist rules if possible if command -v iptables-save &>/dev/null; then if [[ -d /etc/iptables ]]; then iptables-save > /etc/iptables/rules.v4 2>/dev/null && \ write_status "Rules persisted to /etc/iptables/rules.v4" "Info" || \ write_status "Could not persist rules to /etc/iptables/rules.v4" "Warning" elif [[ -f /etc/sysconfig/iptables ]]; then iptables-save > /etc/sysconfig/iptables 2>/dev/null && \ write_status "Rules persisted to /etc/sysconfig/iptables" "Info" || \ write_status "Could not persist rules to /etc/sysconfig/iptables" "Warning" else write_status "iptables rules applied but persistence mechanism not detected. Rules will not survive reboot." "Warning" write_status "Consider running: iptables-save > /etc/iptables/rules.v4" "Info" fi fi firewall_applied=true elif command -v nft &>/dev/null; then write_status "Using nftables for firewall rules." "Info" # Delete existing table if present nft delete table inet "$IPTABLES_CHAIN" 2>/dev/null || true # Build nftables ruleset nft_rules="table inet $IPTABLES_CHAIN { chain input { type filter hook input priority -1; policy accept; " if [[ ${#TRUSTED_CLUSTER_PEERS[@]} -gt 0 ]]; then peer_set=$(printf ", %s" "${TRUSTED_CLUSTER_PEERS[@]}") peer_set="${peer_set:2}" # Remove leading ", " nft_rules+=" tcp dport $TRIBES_PORT ip saddr { $peer_set } accept " fi nft_rules+=" tcp dport $TRIBES_PORT drop } }" echo "$nft_rules" | nft -f - if [[ ${#TRUSTED_CLUSTER_PEERS[@]} -gt 0 ]]; then write_status "Created nftables rules: ALLOW ${#TRUSTED_CLUSTER_PEERS[@]} peer(s), DROP all others on TCP/$TRIBES_PORT." "Success" else write_status "Created nftables rule: DROP ALL inbound TCP/$TRIBES_PORT." "Success" fi firewall_applied=true elif command -v firewall-cmd &>/dev/null; then write_status "Using firewalld for firewall rules." "Info" # Add a rich rule to drop port 4000 if [[ ${#TRUSTED_CLUSTER_PEERS[@]} -gt 0 ]]; then # Block all first firewall-cmd --permanent --add-rich-rule="rule family=ipv4 port port=$TRIBES_PORT protocol=tcp drop" 2>/dev/null # Allow trusted peers for peer in "${TRUSTED_CLUSTER_PEERS[@]}"; do firewall-cmd --permanent --add-rich-rule="rule family=ipv4 source address=$peer port port=$TRIBES_PORT protocol=tcp accept" 2>/dev/null write_status "Created firewalld ALLOW rule for peer: $peer" "Success" done else firewall-cmd --permanent --add-rich-rule="rule family=ipv4 port port=$TRIBES_PORT protocol=tcp drop" 2>/dev/null fi firewall-cmd --reload 2>/dev/null write_status "firewalld rules applied and reloaded." "Success" firewall_applied=true else write_status "No supported firewall tool found (iptables, nft, firewall-cmd). Firewall mitigation SKIPPED." "Error" write_status "Manually block inbound TCP/$TRIBES_PORT on your network/host firewall." "Warning" fi [[ "$firewall_applied" == true ]] && write_status "Firewall mitigation applied successfully." "Success" # ======================================================================== # Discovery: Find Tomcat Installations # ======================================================================== declare -A TOMCAT_PATHS add_tomcat_path() { local path="$1" path=$(realpath "$path" 2>/dev/null || echo "$path") if [[ -d "$path" && -z "${TOMCAT_PATHS[$path]+_}" ]]; then TOMCAT_PATHS["$path"]=1 fi } # Environment variables [[ -n "${CATALINA_HOME:-}" && -d "${CATALINA_HOME}" ]] && add_tomcat_path "$CATALINA_HOME" [[ -n "${CATALINA_BASE:-}" && -d "${CATALINA_BASE}" ]] && add_tomcat_path "$CATALINA_BASE" # Running processes while IFS= read -r proc_line; do if [[ "$proc_line" =~ -Dcatalina\.home=([^[:space:]]+) ]]; then [[ -d "${BASH_REMATCH[1]}" ]] && add_tomcat_path "${BASH_REMATCH[1]}" fi done < <(ps aux 2>/dev/null | grep '[c]atalina' || true) # Common paths for pattern in /opt/tomcat /opt/apache-tomcat* /usr/share/tomcat* /usr/local/tomcat* \ /var/lib/tomcat* /srv/tomcat* /opt/bitnami/apache-tomcat*; do for dir in $pattern; do [[ -d "$dir" ]] && add_tomcat_path "$dir" done done # ======================================================================== # MITIGATION 2: Harden server.xml — Disable Tribes Clustering # ======================================================================== write_status "------------------------------------------------------" "Info" write_status "MITIGATION 2: Scanning Tomcat installations to harden server.xml." "Check" for install_path in "${!TOMCAT_PATHS[@]}"; do write_status "Processing: $install_path" "Info" server_xml="${install_path}/conf/server.xml" if [[ ! -f "$server_xml" ]]; then write_status "server.xml not found at $server_xml - skipping." "Warning" continue fi has_cluster=$(grep -c '/dev/null || echo "0") if [[ "$has_cluster" -gt 0 ]]; then if [[ ${#TRUSTED_CLUSTER_PEERS[@]} -eq 0 ]]; then # No peers defined — disable clustering timestamp=$(date +%Y%m%d_%H%M%S) backup_path="${server_xml}.bak_${CVE_ID}_${timestamp}" cp -p "$server_xml" "$backup_path" write_status "Backup created: $backup_path" "Info" # Comment out Cluster elements (handles both self-closing and block) # Self-closing: sed -i 's|^$\s*]*/>$|\n|g' "$server_xml" # Block: ... (multi-line via perl for safety) if command -v perl &>/dev/null; then perl -0777 -i -pe \ 's|(^\s*)|\n|gms' \ "$server_xml" 2>/dev/null || true fi # Verify the change remaining=$(grep -c '^\s*/dev/null || echo "0") if [[ "$remaining" -eq 0 ]]; then write_status "Tribes clustering DISABLED in server.xml (commented out)." "Success" write_status "A Tomcat restart is required for this change to take effect." "Warning" else write_status "Could not fully comment out Cluster element. Manual review recommended." "Warning" fi else write_status "Tribes clustering active with trusted peers defined - preserving configuration." "Info" write_status "Firewall rules restrict access to trusted peers only." "Info" fi else write_status "No Tribes clustering configured in server.xml - no changes needed." "Info" fi # ==================================================================== # MITIGATION 3: Neutralize Dangerous Gadget Chain Libraries # ==================================================================== write_status "------------------------------------------------------" "Info" write_status "MITIGATION 3: Scanning for dangerous deserialization gadget libraries." "Check" # Scan main lib directory lib_dir="${install_path}/lib" if [[ -d "$lib_dir" ]]; then for pattern in "${DANGEROUS_LIB_PATTERNS[@]}"; do while IFS= read -r jar_file; do [[ -z "$jar_file" ]] && continue disabled_name="${jar_file}.DISABLED_${CVE_ID}" if mv "$jar_file" "$disabled_name" 2>/dev/null; then write_status "Neutralized gadget library: $(basename "$jar_file") -> $(basename "$disabled_name")" "Success" else write_status "Could not rename $(basename "$jar_file")" "Warning" fi done < <(find "$lib_dir" -maxdepth 1 -name "$pattern" -type f 2>/dev/null) done fi # Scan WEB-INF/lib in each webapp webapps_dir="${install_path}/webapps" if [[ -d "$webapps_dir" ]]; then for pattern in "${DANGEROUS_LIB_PATTERNS[@]}"; do while IFS= read -r jar_file; do [[ -z "$jar_file" ]] && continue disabled_name="${jar_file}.DISABLED_${CVE_ID}" if mv "$jar_file" "$disabled_name" 2>/dev/null; then write_status "Neutralized webapp gadget library: $(basename "$jar_file") in $(dirname "$jar_file")" "Success" else write_status "Could not rename $(basename "$jar_file")" "Warning" fi done < <(find "$webapps_dir" -path "*/WEB-INF/lib/$pattern" -type f 2>/dev/null) done fi write_status "Gadget library scan complete for: $install_path" "Info" # ==================================================================== # MITIGATION 4: JEP 290 Deserialization Filter (catalina.properties) # ==================================================================== write_status "------------------------------------------------------" "Info" write_status "MITIGATION 4: Configuring JEP 290 deserialization filter." "Check" catalina_props="${install_path}/conf/catalina.properties" if [[ -f "$catalina_props" ]]; then # Check if a filter is already set if grep -q '^jdk.serialFilter' "$catalina_props" 2>/dev/null; then write_status "JEP 290 filter already configured in catalina.properties - skipping." "Info" else # Backup cp -p "$catalina_props" "${catalina_props}.bak_${CVE_ID}_$(date +%Y%m%d_%H%M%S)" # Append a restrictive filter that blocks known gadget chain classes cat >> "$catalina_props" <<'FILTER_EOF' # CVE-2026-34486 MITIGATION: JEP 290 deserialization filter # Blocks known gadget chain classes from being deserialized jdk.serialFilter=\ !org.apache.commons.collections.functors.**;\ !org.apache.commons.collections4.functors.**;\ !org.apache.commons.beanutils.**;\ !com.sun.org.apache.xalan.internal.xsltc.trax.**;\ !org.codehaus.groovy.runtime.**;\ !org.springframework.beans.factory.**;\ * FILTER_EOF write_status "JEP 290 deserialization filter added to catalina.properties." "Success" write_status "Blocked classes: commons-collections functors, commons-beanutils, xalan, groovy, spring." "Info" fi else write_status "catalina.properties not found at $catalina_props - JEP 290 filter skipped." "Warning" fi done if [[ ${#TOMCAT_PATHS[@]} -eq 0 ]]; then write_status "No Tomcat installations found. Firewall rule applied as a preventive measure." "Info" fi # ======================================================================== # Final Result — Success # ======================================================================== write_status "------------------------------------------------------" "Info" write_status "REMEDIATION COMPLETE: All mitigations applied successfully." "Success" write_status "Summary of applied mitigations:" "Info" write_status " 1. Inbound TCP/$TRIBES_PORT blocked via host firewall." "Info" if [[ ${#TRUSTED_CLUSTER_PEERS[@]} -eq 0 ]]; then write_status " 2. Tribes clustering disabled in server.xml (where found)." "Info" else write_status " 2. Tribes clustering preserved; firewall allows only trusted peers." "Info" fi write_status " 3. Dangerous deserialization gadget libraries neutralized (where found)." "Info" write_status " 4. JEP 290 deserialization filter applied to catalina.properties (where found)." "Info" write_status " IMPORTANT: Restart Tomcat services for changes to take effect." "Warning" write_status " IMPORTANT: Upgrade to Tomcat 11.0.21 / 10.1.54 / 9.0.117 as the permanent fix." "Warning" echo "RESULT=$CVE_ID|MITIGATED|TRUE" } || { # ======================================================================== # Final Result — Failure # ======================================================================== write_status "------------------------------------------------------" "Info" write_status "REMEDIATION FAILED: An error occurred during mitigation." "Error" echo "RESULT=$CVE_ID|MITIGATED|FALSE" }

Description