CVE-2025-24813 PoC — Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Source

https://github.com/issamjr/CVE-2025-24813-Scanner

Associated Vulnerability

Title:Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)
Description:Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

Description

CVE-2025-24813 - Apache Tomcat Vulnerability Scanner

Readme

# CVE-2025-24813-Scanner
# CVE-2025-24813 - Apache Tomcat Vulnerability Scanner

## Overview
CVE-2025-24813 is a critical security vulnerability in **Apache Tomcat**, allowing attackers to exploit improperly handled **partial PUT requests**. This vulnerability can lead to **Remote Code Execution (RCE)**, **data leaks**, and **file uploads** that could compromise the server.

This repository provides a Python-based scanner (`CVE-2025-24813.py`) to check if a target Apache Tomcat server is vulnerable.

---

## Affected Versions
The following **Apache Tomcat** versions are affected:

- **9.0.0.M1 to 9.0.98**
- **10.1.0-M1 to 10.1.34**
- **11.0.0-M1 to 11.0.2**

If your server runs any of these versions, you should **immediately update** to a patched version.

---

## How the Exploit Works
The vulnerability arises from Tomcat’s mishandling of **partial PUT requests**. Attackers can:
- Upload malicious JSP files
- Bypass security restrictions
- Execute arbitrary code on the server

The scanner tests for this vulnerability by sending a **PUT request** with a test file and checking the server’s response.

---

## Installation
Clone the repository and install the required dependencies:

```sh
git clone https://github.com/issamjr/CVE-2025-24813-Scanner.git
cd CVE-2025-24813-Scanner
pip install -r requirements.txt
```
## Usage
Run the scanner against a target server:

```sh
python3 CVE-2025-24813.py http://target-ip:port
```

Example:

```sh
python3 CVE-2025-24813.py http://192.168.1.1:8080
```

### Output:
- **Vulnerable Server** (Green Output):
  ```
  [+] Target is vulnerable to CVE-2025-24813!
  ```
- **Not Vulnerable** (Red Output):
  ```
  [-] Target is not vulnerable.
  ```
- **Connection Issues** (Yellow Output):
  ```
  [!] Failed to connect to target.
  ```

---

## Mitigation
To protect your server from CVE-2025-24813:
1. **Update Apache Tomcat** to the latest patched version:
   - **9.0.99 or later**
   - **10.1.35 or later**
   - **11.0.3 or later**
   
2. **Disable Partial PUT Requests** if not needed.

3. **Monitor Logs** for unauthorized file uploads.
## References
- [Apache Security Advisory](https://tomcat.apache.org/security-2025.html)
- [Security Online Report](https://securityonline.info/cve-2025-24813-flaw-in-apache-tomcat-exposes-servers-to-rce-data-leaks-update-immediately/)
- [IONIX Blog on CVE-2025-24813](https://www.ionix.io/blog/apache-tomcat-path-equivalence-vulnerability-cve-2025-24813/)

File Snapshot


 [4.0K]  /data/pocs/46b60269d2359f99d27a0a4c9909f4942aa75b85
├── [1.2K]  CVE-2025-24813.py
├── [2.4K]  README.md
└── [  18]  requirements.txt

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!