Associated Vulnerability
Title:Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)Description:Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.
Description
A simple, easy-to-use POC for CVE-2025-42813 (Apache Tomcat versions below 9.0.99).
Readme
# CVE-2025-24813 Proof-of-Concept (Standalone)
This repository contains a non-destructive, standalone PoC for [CVE-2025-24813](https://nvd.nist.gov/vuln/detail/CVE-2025-24813), a vulnerability in Apache Tomcat 9.0.55 allowing remote file upload via partial `PUT` requests. This exploit demonstrates code execution by uploading and accessing a benign JSP file.
---
## 📁 Contents
- `proof.jsp`: Harmless JSP payload to demonstrate code execution.
- `cve_2025_24813_client_demo.py`: Python3 script to detect, exploit, verify, log, and clean up.
- `report.txt`: Auto-generated log of the testing session.
---
## 🧰 Requirements
- Python 3.7+
- Optional: `html2image` for screenshot capture:
```bash
pip install html2image
```
---
## 🖥️ Usage
```bash
python3 cve_2025_24813_client_demo.py
```
You will be prompted for:
- Target IP or hostname (e.g., `192.168.1.100`)
- Target port (e.g., `8080`)
---
## 🔍 Features
- ✅ Partial PUT vulnerability check (CVE-2025-24813)
- ✅ Optional screenshot capture (via `html2image`)
- ✅ Interactive prompts and confirmation before exploitation
- ✅ Color-coded terminal output
- ✅ Logs to `report.txt`
- ✅ Auto cleanup via HTTP DELETE after 24 hours
---
## ⚠️ Safety & Ethics
This PoC is **completely innocuous**. It does:
- No persistence
- No shell, no command execution
- Just uploads and accesses a static JSP
Use only on systems you are **authorized** to test.
---
## 📸 Example Output
```bash
[✔] Server appears to support partial PUT!
[✅] Exploit verified: JSP executed successfully.
[URL] http://target:8080/uploads/proof.jsp
[*] Sleeping for 24.0 hours before cleanup...
```
---
## 📦 Packaging for GitHub
- This repo is ready for GitHub publishing.
- Add a license of your choice (e.g. MIT).
- Push with:
```bash
git init
git add .
git commit -m "Initial CVE-2025-24813 PoC"
git remote add origin https://github.com/YOURUSERNAME/cve-2025-24813-poc.git
git push -u origin main
```
---
## 🧼 Cleanup
After 24 hours, the script automatically issues an HTTP `DELETE` to remove the JSP. You can also remove it manually.
---
## 📄 License
MIT or custom license of your choice.
---
## ✉️ Contact
Maintained by [Your Name]. For authorized use only.
## 📛 GitHub Badges
---
## 🧩 Full Feature List
- ✅ Interactive CLI for target IP/port input
- ✅ Vulnerability detection via:
- Partial PUT test
- Fallback header analysis (`Server: Apache/Tomcat`)
- ✅ User confirmation before exploitation
- ✅ Harmless `proof.jsp` upload with no side effects
- ✅ Live verification via HTTP GET
- ✅ Color-coded terminal output (green, yellow, red)
- ✅ Screenshot capture with `html2image`
- ✅ Auto-cleanup via HTTP DELETE after 24 hours
- ✅ All activity logged to `report.txt`
- ✅ `.gitignore`, `LICENSE`, GitHub badges
- ✅ GitHub Pages + release-ready metadata
- ✅ `setup.sh` for optional environment prep
- ✅ Disclosure template `disclosure.md` for blog/report use
- ✅ GitHub banner image `banner.png`
---
## 🧠 Notes
This project is designed to be shared publicly and used responsibly. If you find it useful, consider starring the repo and contributing via issues or pull requests.
File Snapshot
[4.0K] /data/pocs/65d6ccbcaf80d3b65ce524249f95099c54ce07a6
├── [1.0K] LICENSE
└── [3.3K] README.md
0 directories, 2 files
Remarks
1. It is advised to access via the original source first.
2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →