CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability
Introduction:
Apache Tomcat is a widely used open-source Java Servlet container developed by the Apache Software Foundation. It powers a significant portion of enterprise-grade Java web applications and provides functionality of JSP pages, and session management. On March 10, 2025, CVE-2025-24813 vulnerability was reported in Apache Tomcat. It was later added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on April 1, 2025. This vulnerability affects Apache Tomcat versions from 9.0.1 to 9.0.99, 10.1.1 to 10.1.35, and 11.0.1 Up to 11.0.3 and is classified as a Path Equivalence vulnerability.
In this blog, we will discuss about the cause of the vulnerability, including how to reproduce a vulnerable Tomcat setup and exploit it while gaining remote code execution on the system.
Understanding the Vulnerability:
The root cause of CVE-2025-24813 lies in how Apache Tomcat processes PUT requests and maps request URIs to internal file paths without proper validation or isolation from the session persistence layer.
When a PUT request is made to a path like /random/session, Tomcat internally maps this to a file name such as .random.session and vice versa, this conversion is handled by the DefaultServlet, where slashes are replaced with dots. If the PUT request includes a Content-Range header, Tomcat calls executePartialPut() to handle partial file updates which adds complexity but follows the same unsafe path mapping logic.
Tomcat also stores user sessions as serialized Java objects in disk files, typically named based on the JSESSIONID value (e.g., .random.session). When a request with Cookie: JSESSIONID=.random is received, Tomcat attempts to deserialize the corresponding session file.
If an attacker first sends a PUT request with malicious serialized payload to a path like /random/session, the server will create a file named .random.session due to the path-to-file conversion. As the payload contains a malicious Java serialized object, Tomcat will later load and deserialize this object when the session is accessed leading to unauthenticated remote code execution on victim system.
Attack Flow:
Figure 1: Attack Flow
Setting Up the Vulnerable Environment :
Manual Setup :
Download a known vulnerable release, such as Tomcat 9.0.98, from here.
(a)Enable WriteAccess via DefaultServlet to disable the default read-only mode and allow PUT and DELETE methods to function on the DefaultServlet. Find <servlet-name>default</servlet-name> section and add the following:
(b)Enable File-Based Session Storage
To trigger the deserialization path during exploitation, configure Tomcat to use persistent file-based sessions:
Add the following inside the <Context> block:
Docker-Based Setup :
If you prefer a containerized lab environment, you can get the docker compose configuration file from here.
Exploiting the Vulnerability:
Now, we need to craft a malicious serialized payload and send it to the vulnerable Tomcat server. We can achieve this using ysoserial
ysoserial:
It is a tool used to generate malicious serialized Java objects to exploit deserialization vulnerabilities.It creates a payload containing a gadget chain (e.g., CommonsBeanutils1), which are pre-existing Java class sequences that can be used to execute arbitrary code upon deserialization. You can download it from here .
To generate the malicious serialised payload we can run the following command
Note: “touch /tmp/success” is the command we want to execute on the server.
The following python script is used to deliver the payload to Apache Tomcat vulnerable server
Once the deserialization happens of the payload (as shown in the attack flow) , it executes the command “touch /tmp/success” which creates a file named success in /tmp directory , hence achieving remote code execution.
Conclusion:
To protect against these vulnerabilities, it is crucial to update to the latest Apache Tomcat release. Leveraging threat detection solutions can further strengthen your defenses against emerging threats and ensure the continued integrity of your systems. You can also use the Keysight test platforms with ATI subscription to safeguard your network against such attacks.
Leverage Subscription Service To Stay Ahead Of Attacks:
Keysight's Application and Threat Intelligence (ATI) Subscription provides daily malware and bi-weekly updates of the latest application protocols and vulnerabilities for use with Keysight test platforms. The ATI Research Center continuously monitors threats as they appear in the wild and has just released a strike for this CVE as part of BreakingPoint System’s recent update 2025-07 help keep your network secure. More information is present here.
The following images show the screenshots of the CVEs as a strike in BreakingPoint System:
References:
https://nvd.nist.gov/vuln/detail/CVE-2025-24813
https://github.com/charis3306/CVE-2025-24813