CVE-2025-24813 PoC — Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Title:Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)
Description:Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

cve-2025-24813验证脚本

# cve-2025-24813_poc

cve-2025-24813验证脚本

## 影响版本

- 9.0.0.M1 <= tomcat <= 9.0.98
- 10.1.0-M1 <= tomcat <= 10.1.34
- 11.0.0-M1 <= tomcat <= 11.0.2

## 检测方式

```shell
python .\CVE-2025-24813-poc.py -u {url}
```

![image](https://github.com/user-attachments/assets/da5beba4-acbe-4f67-badd-16f7af46dff9)

## 免责声明

此脚本仅供合法安全研究和教育目的使用。未经授权，禁止在未经目标系统所有者明确同意的情况下进行任何形式的攻击、侵入或干扰。用户应遵守所有适用的法律和规定，尤其是在使用本工具时涉及到个人隐私、系统安全以及网络安全方面的法律。
- 本工具由开发者提供，仅用于安全研究和教育目的。
- 开发者不对因使用本工具造成的任何非法行为、数据丢失、系统损坏或其他损害负责。
- 开发者不为用户滥用工具产生的任何后果承担责任。
- 开发者不保证本工具的完整性、准确性或可用性，使用者需要自行承担风险。

 [4.0K]  /data/pocs/0daa76f5b35de67033e7c2969c6c613630b96f96
├── [2.7K]  CVE-2025-24813-poc.py
└── [1.0K]  README.md

0 directories, 2 files