CVE-2025-55752 PoC — Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled

Source

https://github.com/AuroraSec-Pivot/CVE-2025-55752

Associated Vulnerability

Title:Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled (CVE-2025-55752)
Description:Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.

Description

基于 Docker 的重现环境，用于复现 Apache Tomcat 10.1.44 中的路径遍历漏洞 CVE-2025-55752。本实验场景可以复现官网报道的RCE

Readme

# CVE-2025-55752：Apache Tomcat 路径遍历漏洞

基于 Docker 的复现环境，用于重现 Apache Tomcat 10.1.44 中的路径遍历漏洞 CVE-2025-55752。

## 概述

CVE-2025-55752 是 Apache Tomcat 中 RewriteValve 组件的一个路径遍历漏洞，由于 URL 规范化处理顺序不当导致：URL 规范化发生在 URL 解码之前。这使得攻击者能够使用 URL 编码的路径遍历序列（如 `..%2f`）绕过安全约束，访问受保护的目录（如 `/WEB-INF/`）。

## 漏洞特性

- **CVE ID**: CVE-2025-55752
- **CVSS v3.1**: 7.5（高危）
- **CWE**: CWE-22（路径遍历）
- **受影响组件**: Apache Tomcat RewriteValve
- **根本原因**: 先规范化后解码的处理顺序

## 受影响的版本

| 系列 | 受影响的版本 | 已修复版本 |
|------|-------------|-----------|
| 11.x | 11.0.0-M1 到 11.0.10 | 11.0.11+ |
| 10.1.x | 10.1.0-M1 到 10.1.44 | 10.1.45+ |
| 9.0.x | 9.0.0-M11 到 9.0.108 | 9.0.109+ |
| 8.5.x | 8.5.6 到 8.5.100 | EOL - 无补丁 |

## 快速开始

### 前置要求

- Docker
- Docker Compose

### 环境搭建

1. 克隆此仓库：
```bash
git clone https://github.com/AuroraSec-Pivot/CVE-2025-55752.git
cd CVE-2025-55752
```

2. 启动漏洞环境：
```bash
docker-compose up -d
```

3. 环境将在以下地址启动：
   - Tomcat 应用：http://localhost:8080

### 漏洞验证

使用以下 URL 路径测试路径遍历漏洞：

```
http://localhost:8080/rewrite/..%2fWEB-INF/web.xml
```

如果漏洞存在，将能够成功访问到受保护的 `/WEB-INF/web.xml` 文件。

### 停止环境

```bash
docker-compose down
```

## 技术细节

### 漏洞原理

该漏洞源于 RewriteValve 组件在处理 URL 时的错误顺序：
1. 首先对 URL 进行规范化处理
2. 然后才对 URL 进行解码

这种处理顺序使得攻击者可以使用 URL 编码的路径遍历序列（如 `%2e%2e%2f` 或 `..%2f`）绕过安全检测，访问本应受保护的资源。

### 修复方案

升级到已修复的 Tomcat 版本：
- Tomcat 11.0.11+
- Tomcat 10.1.45+ 
- Tomcat 9.0.109+

## 免责声明

此环境仅用于教育目的和安全研究。请勿用于非法用途。使用者需自行承担风险，作者不承担任何法律责任。

## 参考资料

- [Apache Tomcat 安全公告](https://tomcat.apache.org/security-10.html)
- [CVE-2025-55752 详细信息](https://nvd.nist.gov/vuln/detail/CVE-2025-55752)

File Snapshot


 [4.0K]  /data/pocs/3eb3e03589891c44ea34796b0ce480e0a0be2eee
├── [ 426]  docker-compose.yml
└── [2.4K]  README.md

1 directory, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!