Severe Vulnerability in Apache Tomcat

This week, the NIST disclosed a critical vulnerability affecting Apache Tomcat. The flaw, identified as CVE-2025-24813, allows attackers to execute code remotely – and, in certain configurations, also enables the viewing or modification of sensitive files.

Vulnerability Overview

The vulnerability is related to how Tomcat handles PUT requests for file uploads. In implementations that use file-based session persistence and leave the default servlet with write enabled (which, by default, is disabled), an attacker can exploit the flaw in two steps:

1. Malicious Injection:
   The attacker sends a PUT request to the server, uploading a malicious session file. This file contains a Base64 payload – usually generated with the ysoserial tool – which, when deserialized, executes arbitrary code.
   
   

2. Payload Execution:
   Next, a GET request is made using the session ID (JSESSIONID) corresponding to the injected file. When processing this session, Tomcat deserializes the content and executes the embedded code, granting the attacker privileged access to the system.

This technique is considered easy to exploit, as in environments where session persistence is done via files and the PUT method is allowed, the attacker does not need prior authentication to perform the attack.

Affected Versions and Exploit Scenarios

The vulnerability impacts the following versions of Apache Tomcat:

• Tomcat 11: from 11.0.0-M1 to 11.0.2

• Tomcat 10.1: from 10.1.0-M1 to 10.1.34

• Tomcat 9: from 9.0.0.M1 to 9.0.98

For the attack to be successful, certain specific conditions must be present:

• Write Enabled in Default Servlet:
  The readonly parameter must be configured as false (a configuration not recommended and disabled by default).

• Partial PUT Support:
  This feature is enabled by default and allows partial file uploads.

• File-Based Session Persistence:
  The use of default file-based session storage, combined with the presence of a library susceptible to unsafe deserialization.

• Prior Knowledge of Sensitive Files:
  In scenarios where the sensitive file upload URL is a subdirectory of the public URL, the attacker needs to know the names of these files to manipulate them.

See a POC here.

Mitigation and Recommendations

Given the scenario presented, it is essential that organizations using Apache Tomcat review their configurations and apply the recommended updates. The following actions are recommended:

1. Immediate Update:
   Update to the versions that have already patched the vulnerability:

• Tomcat 11: update to 11.0.3

• Tomcat 10.1: update to 10.1.35

• Tomcat 9: update to 9.0.98 

2. Review Default Servlet Configuration:
   If updating is not immediately possible, disable writing to the default servlet by setting the readonly parameter to true in the web.xml file. 

3. Disable PUT Requests:
   If it is not essential for your application, disable the PUT method to prevent malicious files from being sent to the server.

“Special attention to methods 2 and 3 as they interfere with how the application uses sessions, as this change could cause it to stop working correctly.”

If you prefer this content in video format, follow our Kubidrops, your knowledge pill from the cloud-native world!

Final Thoughts

The CVE-2025-24813 vulnerability highlights the importance of keeping not only systems updated but also reviewing default configurations – such as enabling potentially dangerous HTTP methods and file-based session persistence. In a scenario where exploitation can be carried out easily and remotely, immediate mitigation becomes indispensable to prevent severe compromises, such as arbitrary code execution and access to sensitive information.

Organizations using Apache Tomcat should prioritize updating to the patched versions and review their security practices, ensuring that upload and session persistence methods are securely configured.