CVE-2025-24813 PoC — Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Source

https://github.com/Mattb709/CVE-2025-24813-PoC-Apache-Tomcat-RCE

Associated Vulnerability

Title:Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)
Description:Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

Readme

# Apache Tomcat CVE-2025-24813 Proof of Concept (PoC)

![License](https://img.shields.io/badge/License-MIT-green.svg)
![Python](https://img.shields.io/badge/Python-3.x-blue.svg)

A proof-of-concept exploit for the Apache Tomcat deserialization vulnerability (CVE-2025-24813). This tool demonstrates how attackers could exploit insecure deserialization in Tomcat's session management.

**WARNING**: This tool is for authorized security testing and educational purposes only. Unauthorized use against systems you don't own is illegal.

## Features

- Supports both default (safe) and custom payloads
- SSL/TLS support (with optional verification bypass)
- Color-coded output for better visibility
- Interactive payload selection
- Configurable timeouts

## Requirements

- Python 3.x
- Required packages (automatically installed via requirements.txt):
  - `requests`
  - `colorama`

## Installation

```bash
git clone https://github.com/yourusername/CVE-2025-24813-PoC.git
cd CVE-2025-24813-PoC
pip install -r requirements.txt
```

## Usage

Basic usage:
```bash
python CVE-2025-24813-PoC.py -t 192.168.1.100 -p 8080
```

Advanced options:
```bash
python CVE-2025-24813-PoC.py \
  -t 10.0.0.1 \
  -p 8443 \
  --protocol https \
  --no-verify \
  --timeout 15
```

### Command Line Arguments
| Argument | Description | Required |
|----------|-------------|----------|
| `-t`, `--target` | Target IP address | Yes |
| `-p`, `--port` | Target port number | Yes |
| `--protocol` | `http` or `https` (default: http) | No |
| `--no-verify` | Disable SSL certificate verification | No |
| `--timeout` | Request timeout in seconds (default: 10) | No |

## Payload Options
1. **Default Payload**: Harmless serialized object (safe for detection)
2. **Custom Payload**: Hex-encoded payload from tools like ysoserial

## Example Output

```plaintext
[*] Apache Tomcat CVE-2025-24813 Exploit PoC 
[!] WARNING: For authorized testing only. Unauthorized use is illegal.

[*] Targeting http://192.168.1.100:8080

[*] Payload Options:
1. Use default dummy payload (safe, for detection)
2. Enter custom payload (hex-encoded, e.g., from ysoserial)
[?] Enter choice (1 or 2): 1
[*] Using default dummy payload.

[*] Attempting exploit...
[+] Success: Deserialization triggered (HTTP 500). Potential RCE if payload is malicious!
```
## Related Tools
For mass scanning vulnerable systems:  
🔍 [CVE-2025-24813-Scanner](https://github.com/Mattb709/CVE-2025-24813-Scanner) - Bulk detection tool for vulnerable Tomcat hosts

## Mitigation
If you're affected by this vulnerability:
1. Upgrade to the latest patched version of Apache Tomcat
2. Consider using a serialization filter

## Legal Disclaimer
This software is provided under the MIT License. The author is not responsible for any misuse of this tool. Always obtain proper authorization before testing systems.

## License
MIT License - See [LICENSE](LICENSE) file for details.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →