CVE-2026-65905 Google Chronicle · YARA-L

Detect Apache Tomcat DIGEST Authenticator Capture-Replay Authentication Bypass (CVE-2026-65905) in Google Chronicle

Detects exploitation attempts and vulnerable configurations related to CVE-2026-65905, an authentication bypass by capture-replay in Apache Tomcat's DIGEST authenticator. Due to improper nonce/nonce-count validation (CWE-294), a network attacker who can capture a valid HTTP DIGEST Authorization header can replay it to authenticate as the victim, bypassing authentication (CVSS 9.8). Detection focuses on repeated DIGEST Authorization headers reusing identical nonce/cnonce/response values, anomalous nonce-count (nc) reuse or non-monotonic nc sequences, and successful authenticated access following replayed credentials against Tomcat instances. Affected: Tomcat 11.0.0-M1<11.0.25, 10.1.0-M1<10.1.58, 9.0.0.M1<9.0.121, 8.5.0<=8.5.100, 7.0.30<=7.0.109.

MITRE ATT&CK

Tactic
Initial Access Credential Access

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule tomcat_digest_replay_cve_2026_65905 {
  meta:
    author = "argus"
    description = "Apache Tomcat DIGEST capture-replay auth bypass CVE-2026-65905"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    re.regex($e.network.http.user_agent, ".*") 
    $auth = $e.additional.fields["authorization"]
    re.regex($auth, `(?i)Digest.*nonce=.*response=`)
    $nonce = $auth
    $ip = $e.principal.ip
  match:
    $nonce over 1h
  condition:
    $e and #ip > 1
}
high severity low confidence

YARA-L rule matching identical DIGEST Authorization headers observed from more than one principal IP within an hour.

Data Sources

Chronicle NETWORK_HTTPWeb Proxy Telemetry

Required Tables

network_http

False Positives & Tuning

  • Authorization field not normalized into additional.fields
  • Shared upstream credential from proxy tiers
  • Legitimate reuse within nonce validity window

Other platforms for CVE-2026-65905

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Replay captured DIGEST Authorization header

    Expected signal: Web access log records an identical DIGEST Authorization header (same nonce and response) from a new source IP.

  2. Test 2Reuse identical nonce-count across requests

    Expected signal: Two access-log entries with identical nonce and nc=00000001 for the same URI.

  3. Test 3Confirm DIGEST authenticator enabled on vulnerable Tomcat

    Expected signal: Server responds with 401 and a 'WWW-Authenticate: Digest' header disclosing realm and nonce.

Last updated: 2026-09-04 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the target host runs an affected Apache Tomcat version (11.0.0-M1<11.0.25, 10.1.0-M1<10.1.58, 9.0.0.M1<9.0.121, 8.5.0<=8.5.100, 7.0.30<=7.0.109) and that a DIGEST authenticator is configured in server.xml/web.xml (auth-method DIGEST).
  2. Extract the reused nonce and response values from the alert and count how many distinct source IPs and User-Agents presented the identical credential; genuine capture-replay shows the same response hash from unrelated clients.
  3. Correlate the replayed request timestamps with the original legitimate authentication to identify whether an attacker window overlaps a captured session, and review what resources were accessed after the replay.
  4. Determine whether the connection was over plaintext HTTP (enabling passive capture) versus TLS, since capture-replay is most feasible on unencrypted or MITM-exposed channels.

Containment

  1. Disable the DIGEST authenticator and switch the affected web application to FORM or CLIENT-CERT authentication over TLS, or place the app behind an authenticating reverse proxy until patched.
  2. Block the offending source IPs at the WAF/firewall and invalidate active sessions; force credential reset for any account whose DIGEST response was replayed.
  3. Enforce HTTPS-only (redirect HTTP->HTTPS, enable HSTS) to eliminate the passive capture vector while patching proceeds.

Evidence Collection

  1. Preserve raw web/access logs and any packet captures showing the original and replayed Authorization headers, including full nonce, nc, cnonce and response fields.
  2. Capture the Tomcat version banner, server.xml, and web.xml auth configuration for the affected connector/context.
  3. Export the correlated alert timeline (first-seen legitimate auth vs replayed requests) and the list of resources accessed under the replayed identity.

Escalation Criteria

  • !Escalate to incident response if a replayed DIGEST credential resulted in successful access to sensitive endpoints or data exfiltration.
  • !Escalate to vulnerability management for emergency patching if any internet-facing Tomcat instance is confirmed on an affected version with DIGEST auth enabled.
  • !Escalate if the same replayed credential is observed against multiple hosts, indicating lateral or campaign activity.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Tomcat/Apache/IIS access logs containing repeated identical DIGEST Authorization headers
  • >server.xml and web.xml showing DIGEST auth-method configuration and Tomcat version
  • >Packet captures or proxy logs evidencing the captured-then-replayed nonce/response pair

Tuning Guidance

Baseline legitimate shared-credential and monitoring traffic first, then whitelist known health-check source IPs and service accounts. Raise the distinct-source threshold in NAT-heavy environments and lower the correlation window if the server uses short nonce lifetimes. Focus on plaintext-HTTP paths and DIGEST-configured contexts to reduce noise, and prioritize alerts where the replayed request accessed protected resources.

Hunting Queries

Hunts for identical DIGEST nonces reused across requests with repeated or non-monotonic nonce-count (nc) values, which indicates replay rather than a fresh client challenge.

Hunting — KQL
kql 
W3CIISLog | extend AuthHeader = tostring(column_ifexists("csAuthorization","")) | where AuthHeader has "Digest" | extend Nonce=extract(@'nonce="?([^",]+)"?',1,AuthHeader), NC=extract(@'nc=([0-9a-fA-F]+)',1,AuthHeader) | summarize NCs=make_set(NC,50), Reqs=count() by Nonce, cIP | where Reqs>1
Hunting — SPL
spl 
index=web (sourcetype=iis OR sourcetype=tomcat:access) | rex field=_raw "nonce=\"?(?<nonce>[^\",]+)\"?" | rex field=_raw "nc=(?<nc>[0-9a-fA-F]+)" | stats values(nc) as ncs count by nonce src_ip | where count>1

Atomic Red Team Tests

Test 1 Replay captured DIGEST Authorization header
linux

In a lab, capture a valid DIGEST Authorization header from a legitimate authenticated request and replay it verbatim from a second host to confirm the server accepts the reused nonce+response.

Command

bash 
AUTH='Digest username="user", realm="tomcat", nonce="abc123", uri="/protected/", response="deadbeefdeadbeefdeadbeefdeadbeef", nc=00000001, cnonce="xyz", qop=auth'; curl -s -o /dev/null -w "%{http_code}\n" -H "Authorization: $AUTH" http://tomcat-lab:8080/protected/

Cleanup

bash 
unset AUTH

Expected Telemetry

Web access log records an identical DIGEST Authorization header (same nonce and response) from a new source IP.

Expected Detection

Detection fires on identical nonce+response reuse across multiple source IPs.

Test 2 Reuse identical nonce-count across requests
linux

Send two requests with the same DIGEST nonce and the same nc value, which a compliant authenticator must reject but a vulnerable one accepts.

Command

bash 
for i in 1 2; do curl -s -o /dev/null -w "%{http_code}\n" -H 'Authorization: Digest username="user", realm="tomcat", nonce="fixednonce", uri="/protected/", response="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", nc=00000001, cnonce="c1", qop=auth' http://tomcat-lab:8080/protected/; done

Cleanup

bash 
echo 'no cleanup required'

Expected Telemetry

Two access-log entries with identical nonce and nc=00000001 for the same URI.

Expected Detection

Hunting query flags reused/non-monotonic nc values for a single nonce.

Test 3 Confirm DIGEST authenticator enabled on vulnerable Tomcat
windows

Enumerate whether the Tomcat instance advertises DIGEST authentication via a WWW-Authenticate challenge, indicating exposure to the capture-replay bypass.

Command

powershell 
curl.exe -s -i http://tomcat-lab:8080/protected/ | findstr /I "WWW-Authenticate Digest Server"

Cleanup

powershell 
echo done

Expected Telemetry

Server responds with 401 and a 'WWW-Authenticate: Digest' header disclosing realm and nonce.

Expected Detection

Configuration hunt identifies DIGEST auth-method on an affected Tomcat version.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0006Credential Access

Related Techniques

T1110Brute ForceT1557Adversary-in-the-MiddleT1212Exploitation for Credential Access

Same Tactic: Initial Access

Popular Detections