Apache Tomcat is below assault as cybercriminals actively exploit a not too long ago disclosed vulnerability, enabling distant code execution (RCE). With easy HTTP requests, attackers can set off the deserialisation of malicious knowledge and achieve management over affected methods.
The vulnerability, CVE-2025-24813, was disclosed by Apache on March 10, with the primary proof of idea being launched on GitHub about 30 hours later, posted by person iSee857. Quickly after, safety agency Wallarm later noticed that this was being leveraged within the wild, warning that the assaults are undetectable to conventional safety filters as HTTP requests seem regular and malicious payloads are base64-encoded.
First, an attacker sends a PUT request containing an encoded, serialised Java payload, which is then written inside Tomcat’s session storage and mechanically saved in a file. Then they ship a GET request with a JSESSIONID cookie pointing to the malicious session.
When Tomcat processes this request, it deserialises the session knowledge with out correct validation, executing the embedded malicious Java code and giving the attacker full distant entry.
SEE: Tips on how to Use the Apache Net Server to Set up and Configure a Web site
Which Apache Tomcat variations are weak?
No authentication is required for this to work however, based on Apache’s safety word, the next should be true for a Tomcat software to be weak:
- Writes are enabled for the default servlet
- Partial PUT request assist is enabled
- Tomcat features a library that could possibly be leveraged in deserialisation assaults
- The default storage location makes use of file-based session persistence
In addition to distant code execution exploits, the vulnerability can enable attackers to view or amend security-sensitive information if the next situations are met:
- Writes are enabled for the default servlet
- Partial PUT request assist is enabled
- The safety-sensitive information are saved in a publicly accessible listing and have been uploaded by partial PUT
- The attacker is aware of the filenames
With these situations fulfilled, the next Tomcat variations are all weak:
- Apache Tomcat 11.0.0-M1 to 11.0.2
- Apache Tomcat 10.1.0-M1 to 10.1.34
- Apache Tomcat 9.0.0.M1 to 9.0.98
Mitigation: Tips on how to defend your system
To mitigate the vulnerability, Apache recommends customers improve to Tomcat variations 11.0.3 or later, 10.1.35 or later, or 9.0.99 or later, respectively, as these are all sufficiently patched. Alternatively, customers can flip off partial PUT assist, disable writes for the default servlet, and keep away from storing security-sensitive information in directories which can be publicly accessible.
Wallarm researchers warn that this vulnerability highlights the potential of different safety flaws rising attributable to Tomcat’s dealing with of partial PUT requests “which permits importing virtually any file anyplace”.
“Attackers will quickly begin shifting their ways, importing malicious JSP information, modifying configurations, and planting backdoors outdoors session storage,” they wrote in a weblog put up. “That is simply the primary wave.”
