#!/usr/bin/env bash # ============================================================================== # SYNOPSIS # Detection script for CVE-2025-23184. # # DESCRIPTION # Best-effort detector for CVE-2025-23184: # - Scans the filesystem for Apache CXF core JARs (cxf-core-*.jar). # - Parses CXF versions and checks if they fall in vulnerable ranges: # * < 3.5.10 # * >= 3.6.0 and < 3.6.5 # * >= 4.0.0 and < 4.0.6 # - Inspects the temp directory for CXF-tagged temp files and classifies # mitigation status based on the presence of stale files. # - Final verdict (VULNERABLE TRUE/FALSE) depends on: # * CXF version status (vulnerable / non-vulnerable) # * Mitigation status (applied / partial / not applied). # # VARIABLES TO DEFINE: # CXF_BASE_DIRS # optional — base paths to scan for cxf-core-*.jar # # default: "/opt /srv /var/lib /var/www /usr/share /usr/local" # TMPDIR # optional — temp directory to inspect (default: /tmp) # CXF_TMP_PATTERN # optional — regex to match CXF temp files (default: "cxf") # CXF_STALE_AGE # optional — age in seconds to treat files as stale # # default: 3600 # # WARNINGS: # # - This script is read-only, but it may be relatively slow on large filesystems # # due to the use of find/stat over multiple base directories. # # - It does NOT guarantee exhaustive coverage if CXF is installed in # # EXECUTION # chmod +x ./detect_cve_2025_23184.sh && ./detect_cve_2025_23184.sh # # or: # # bash ./detect_cve_2025_23184.sh # # DISCLAIMER # VICARIUS STRONGLY RECOMMENDS RUNNING THESE SCRIPTS IN A TEST LAB ENVIRONMENT # BEFORE DEPLOYING THEM TO PRODUCTION. USE AT YOUR OWN DISCRETION ONLY AFTER # CAREFULLY ANALYZING THE CODE. # # AUTHOR # This script has been made by Vicarius Research Team # # VERSION # 1.0 # ============================================================================== # Logging helpers info(){ echo "[i] $*"; } good(){ echo "[+] $*"; } warn(){ echo "[!] $*"; } bad(){ echo "[-] $*"; } # Configuration CXF_BASE_DIRS="${CXF_BASE_DIRS:-/opt /srv /var/lib /var/www /usr/share /usr/local}" TMP_DIR="${TMPDIR:-/tmp}" CXF_TMP_PATTERN="${CXF_TMP_PATTERN:-cxf}" CXF_STALE_AGE="${CXF_STALE_AGE:-3600}" # Global status flags and counters FOUND_CXF_JARS="NO" CXF_VULNERABLE="NO" CXF_SAFE_OR_NEWER="NO" CXF_UNKNOWN_VERSION="NO" CXF_VERSIONS_VULN="" CXF_VERSIONS_SAFE="" CXF_VERSIONS_UNKNOWN="" TMP_MATCHING_COUNT=0 TMP_MATCHING_BYTES=0 TMP_OLD_COUNT=0 TMP_OLD_BYTES=0 DETECT_VULN="FALSE" human_size(){ local bytes="$1" local units=("B" "KiB" "MiB" "GiB" "TiB") local i=0 if [ -z "$bytes" ] || ! printf '%s\n' "$bytes" | grep -Eq '^[0-9]+$'; then bytes=0 fi while [ "$bytes" -ge 1024 ] && [ "$i" -lt 4 ]; do bytes=$(( (bytes + 512) / 1024 )) i=$((i+1)) done printf "%s %s" "$bytes" "${units[$i]}" } normalize_version(){ local ver="$1" local a b c IFS='.' read -r a b c <<< "$ver" a=${a:-0} b=${b:-0} c=${c:-0} printf '%s %s %s\n' "$a" "$b" "$c" } ver_lt(){ local a1 b1 c1 a2 b2 c2 read -r a1 b1 c1 <<< "$(normalize_version "$1")" read -r a2 b2 c2 <<< "$(normalize_version "$2")" if [ "$a1" -lt "$a2" ]; then return 0; fi if [ "$a1" -gt "$a2" ]; then return 1; fi if [ "$b1" -lt "$b2" ]; then return 0; fi if [ "$b1" -gt "$b2" ]; then return 1; fi if [ "$c1" -lt "$c2" ]; then return 0; fi return 1 } ver_ge(){ if ver_lt "$1" "$2"; then return 1 fi return 0 } # Check if CXF version is within CVE-2025-23184 affected ranges is_cxf_version_vulnerable(){ local v="$1" # Range 1: v < 3.5.10 if ver_lt "$v" "3.5.10"; then return 0 fi # Range 2: 3.6.0 <= v < 3.6.5 if ver_ge "$v" "3.6.0" && ver_lt "$v" "3.6.5"; then return 0 fi # Range 3: 4.0.0 <= v < 4.0.6 if ver_ge "$v" "4.0.0" && ver_lt "$v" "4.0.6"; then return 0 fi return 1 } # Scan for cxf-core JARs and evaluate versions scan_cxf_jars(){ for base in $CXF_BASE_DIRS; do [ -d "$base" ] || continue while IFS= read -r -d '' jar; do FOUND_CXF_JARS="YES" local raw_name raw_ver numeric_ver raw_name="$(basename "$jar")" raw_ver="${raw_name#cxf-core-}" raw_ver="${raw_ver%.jar}" numeric_ver="$(printf '%s\n' "$raw_ver" | grep -Eo '[0-9]+(\.[0-9]+){1,2}' | head -n1)" if [ -z "$numeric_ver" ]; then CXF_UNKNOWN_VERSION="YES" if [ -z "$CXF_VERSIONS_UNKNOWN" ]; then CXF_VERSIONS_UNKNOWN="$raw_ver" else CXF_VERSIONS_UNKNOWN="$CXF_VERSIONS_UNKNOWN,$raw_ver" fi continue fi if is_cxf_version_vulnerable "$numeric_ver"; then CXF_VULNERABLE="YES" if [ -z "$CXF_VERSIONS_VULN" ]; then CXF_VERSIONS_VULN="$numeric_ver" else CXF_VERSIONS_VULN="$CXF_VERSIONS_VULN,$numeric_ver" fi else CXF_SAFE_OR_NEWER="YES" if [ -z "$CXF_VERSIONS_SAFE" ]; then CXF_VERSIONS_SAFE="$numeric_ver" else CXF_VERSIONS_SAFE="$CXF_VERSIONS_SAFE,$numeric_ver" fi fi done < <(find "$base" -maxdepth 6 -type f -name 'cxf-core-*.jar' -print0 2>/dev/null) done } scan_cxf_temp_files(){ if [ ! -d "$TMP_DIR" ]; then warn "Temp directory '$TMP_DIR' does not exist; skipping temp file analysis." return fi local now_epoch base size mtime age now_epoch="$(date +%s)" while IFS= read -r -d '' file; do base="$(basename "$file")" if ! printf '%s\n' "$base" | grep -Eiq "$CXF_TMP_PATTERN"; then continue fi size="$(stat -c '%s' "$file" 2>/dev/null || echo 0)" mtime="$(stat -c '%Y' "$file" 2>/dev/null || echo 0)" if ! printf '%s\n' "$mtime" | grep -Eq '^[0-9]+$'; then warn "Could not read mtime for '$file'; skipping." continue fi age=$(( now_epoch - mtime )) TMP_MATCHING_COUNT=$(( TMP_MATCHING_COUNT + 1 )) TMP_MATCHING_BYTES=$(( TMP_MATCHING_BYTES + size )) if [ "$age" -ge "$CXF_STALE_AGE" ]; then TMP_OLD_COUNT=$(( TMP_OLD_COUNT + 1 )) TMP_OLD_BYTES=$(( TMP_OLD_BYTES + size )) fi done < <(find "$TMP_DIR" -maxdepth 1 -type f -print0 2>/dev/null) } info "Starting detection for CVE-2025-23184 (Apache CXF temporary files DoS)." info "Step 1: scanning CXF core libraries..." scan_cxf_jars info "Step 2: inspecting temp directory..." scan_cxf_temp_files echo info "---------- CXF VERSION & TEMP CONFIG ----------" if [ "$FOUND_CXF_JARS" = "YES" ]; then if [ -n "$CXF_VERSIONS_VULN" ]; then info "CXF version(s): vulnerable => $CXF_VERSIONS_VULN" elif [ -n "$CXF_VERSIONS_SAFE" ]; then info "CXF version(s): non-vulnerable => $CXF_VERSIONS_SAFE" elif [ "$CXF_UNKNOWN_VERSION" = "YES" ]; then info "CXF version(s): unknown => $CXF_VERSIONS_UNKNOWN" else info "CXF version(s): UNKNOWN" fi else info "CXF version(s): not detected in scanned paths" fi info "Base paths: $CXF_BASE_DIRS" info "Temp directory: $TMP_DIR" info "Temp name match: $CXF_TMP_PATTERN" info "Stale threshold: ${CXF_STALE_AGE}s" echo info "==================== CVE-2025-23184 SUMMARY ====================" if [ "$FOUND_CXF_JARS" = "YES" ]; then info "CXF presence: FOUND (cxf-core-*.jar in scanned paths)." if [ -n "$CXF_VERSIONS_VULN" ]; then info "CXF version(s): vulnerable => $CXF_VERSIONS_VULN" elif [ -n "$CXF_VERSIONS_SAFE" ]; then info "CXF version(s): non-vulnerable => $CXF_VERSIONS_SAFE" if [ "$CXF_UNKNOWN_VERSION" = "YES" ]; then warn "CXF unknown vers.: $CXF_VERSIONS_UNKNOWN" info "CXF status: Likely NOT VULNERABLE (unknown versions require manual review)." else good "CXF status: NOT VULNERABLE (only fixed/out-of-range versions seen)." fi else if [ "$CXF_UNKNOWN_VERSION" = "YES" ]; then warn "CXF version(s): UNKNOWN (could not parse any version)." warn "CXF status: UNKNOWN (manual verification required)." else info "CXF version(s): N/A" info "CXF status: No CXF versions identified." fi fi else info "CXF presence: NOT FOUND (no cxf-core-*.jar in scanned paths)." info "CXF version(s): N/A" info "CXF status: Host may not be using Apache CXF in scanned locations." fi if [ "$TMP_MATCHING_COUNT" -eq 0 ]; then info "Temp files: no CXF-tagged files found in $TMP_DIR." else total_human="$(human_size "$TMP_MATCHING_BYTES")" old_human="$(human_size "$TMP_OLD_BYTES")" if [ "$TMP_OLD_COUNT" -gt 0 ]; then warn "Temp files: $TMP_MATCHING_COUNT file(s) ($total_human), $TMP_OLD_COUNT stale ($old_human, age >= ${CXF_STALE_AGE}s)." else good "Temp files: $TMP_MATCHING_COUNT file(s) ($total_human), none older than ${CXF_STALE_AGE}s." fi fi MITIGATION_APPLIED="NO" if [ "$CXF_VULNERABLE" = "YES" ]; then if [ "$TMP_OLD_COUNT" -gt 0 ]; then warn "Mitigation status: NOT APPLIED (stale CXF temp files still present)." else if [ "$TMP_MATCHING_COUNT" -eq 0 ]; then MITIGATION_APPLIED="YES" good "Mitigation status: Mitigation IS applied (no CXF-tagged temp files detected at scan time)." info "Temporary mitigation applied; upgrading to a non-vulnerable CXF version is strongly recommended." else info "Mitigation status: PARTIAL / EFFECTIVE (CXF temp files exist but none are stale at scan time)." fi fi else info "Mitigation status: Not required (no vulnerable CXF versions detected in scanned paths)." fi echo if [ "$CXF_VULNERABLE" = "YES" ]; then if [ "$MITIGATION_APPLIED" = "YES" ]; then DETECT_VULN="FALSE" else DETECT_VULN="TRUE" fi else DETECT_VULN="FALSE" fi if [ "$DETECT_VULN" = "TRUE" ]; then bad "Verdict: System IS vulnerable to CVE-2025-23184." echo echo "CVE-2025-23184|VULNERABLE|TRUE" else if [ "$CXF_VULNERABLE" = "YES" ]; then good "Verdict: System is NOT vulnerable to CVE-2025-23184 (temporary mitigation applied; upgrade to a fixed CXF version is still recommended)." else good "Verdict: System is NOT vulnerable to CVE-2025-23184 (no vulnerable CXF version detected in scanned paths)." fi echo echo "CVE-2025-23184|VULNERABLE|FALSE" fi

PoC video

Description