Exploitation of Apache Tomcat Vulnerability CVE-2025-24813

Exploitation of CVE-2025-24813 could allow an attacker to achieve RCE, view security sensitive files, or inject content

Threat ID:: CC-4633
Threat Severity:: Medium
Published:: 17 March 2025 4:13 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Exploitation of CVE-2025-24813 could allow an attacker to achieve RCE, view security sensitive files, or inject content

Affected platforms

The following platforms are known to be affected:

Apache Tomcat

11.0.0-M1 to 11.0.2
10.1.0-M1 to 10.1.34
9.0.0.M1 to 9.0.98

Threat details

Exploitation of CVE-2025-24813

A public proof-of-concept exploit is available for CVE-2025-24813 and exploitation has been reported in the wild. The NHS England National CSOC assesses that continued exploitation of this vulnerability is considered highly likely.

Introduction

The Apache Software Foundation has released security updates addressing a vulnerability in Apache Tomcat. Tomcat is an open-source web server and servlet container that is used to deploy and serve Java-based web applications.

CVE-2025-24813 is 'deserialisation of untrusted data' and 'path equivalence: file.name (Internal dot)' vulnerability that an attacker could exploit to achieve remote code execution (RCE), view security sensitive files, or inject content into those files.

Exploitation of this vulnerability has been reported in the wild and a public proof-of-concept exploit has been released. The NHS England National CSOC assesses that continued exploitation of this vulnerability is considered highly likely.

Conditions required for exploitation

To achieve RCE, the following conditions must be true:

writes enabled for the default servlet (disabled by default)
support for partial PUT (enabled by default) must be present
application is using Tomcat's file based session persistence with the default storage location
application included a library that may be leveraged in a deserialisation attack

Alternatively, to view sensitive files or inject content into those files, the following prerequisite conditions must be met:

writes enabled for the default servlet (disabled by default)
support for partial PUT (enabled by default) must be present
a target URL for security sensitive uploads that is a sub-directory of a target URL for public uploads
attacker knowledge of the names of security sensitive files being uploaded
the security sensitive files also being uploaded via partial PUT

Remediation advice

Affected organisations are encouraged to review the following advisories and apply the relevant updates as soon as practicable.

Remediation steps

Type	Step
Guidance	Update to Apache Tomcat 11.0.3 or later https://tomcat.apache.org/security-11.html
Guidance	Update to Apache Tomcat 10.1.35 or later https://tomcat.apache.org/security-10.html
Guidance	Update to Apache Tomcat 9.0.99 or later https://tomcat.apache.org/security-9.html

Definitive source of threat updates

CVE Vulnerabilities

Status Published

CVE-2025-24813

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.98, which fixes the issue.

Last edited: 17 March 2025 4:13 pm