CVE-2025-24813 PoC — Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Source

https://github.com/maliqto/PoC-CVE-2025-24813

Associated Vulnerability

Title:Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)
Description:Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

Description

PoC para o CVE-2025-24813

Readme

############################################################
#               CVE-2025-24813 - Apache Tomcat             #
#      Prova de Conceito para Execução Remota (RCE)        #
#            PoC por: Maliqto (para fins educativos)       #
############################################################

⚠️ AVISO LEGAL:
Este exploit deve ser utilizado apenas em ambientes de teste controlados com autorização. 
O uso não autorizado contra sistemas de terceiros é crime.

------------------------------------------------------------
📌 DESCRIÇÃO:
Exploit que testa e explora a falha de desserialização no Apache Tomcat 
(versões 9.0.0.M1 até 9.0.98, 10.1.0-M1 até 10.1.34, 11.0.0-M1 até 11.0.2).
Permite execução remota de comandos no servidor vulnerável.

------------------------------------------------------------
🧰 REQUISITOS:

- Python 3
- Java (JDK) instalado
- ysoserial.jar (https://github.com/frohoff/ysoserial)
- Apache Tomcat vulnerável configurado com suporte ao método HTTP PUT

------------------------------------------------------------
📂 ESTRUTURA DO DIRETÓRIO:

/meu-lab/
├── exploit_cve_2025_24813.py
├── ysoserial.jar
└── README_POC_CVE-2025-24813.txt

------------------------------------------------------------
⚙️ USO BÁSICO:

python3 exploit_cve_2025_24813.py http://<alvo>:<porta> \
    --command "<comando>" \
    --ysoserial ysoserial.jar \
    --gadget CommonsCollections6 \
    --payload_type ysoserial

Exemplo:

python3 exploit_cve_2025_24813.py http://localhost:8080 \
    --command "whoami" \
    --ysoserial ysoserial.jar \
    --gadget CommonsCollections6 \
    --payload_type ysoserial

------------------------------------------------------------
🔧 OUTRAS OPÇÕES:

--payload_type java
> Usa payload compilado localmente em Java (sem ysoserial)

--no-ssl-verify
> Desativa verificação SSL (para HTTPS com certificados inválidos)

------------------------------------------------------------
🛡️ MITIGAÇÃO:

- Atualize o Apache Tomcat para versão mais recente
- Desative suporte ao método PUT no `web.xml`
- Aplique regras de firewall e WAF
- Habilite logging e auditoria de uploads/sessões

------------------------------------------------------------
📎 OBSERVAÇÃO FINAL:

Este código foi criado com propósito educacional para demonstrar uma falha real. 
Não nos responsabilizamos por uso indevido.

File Snapshot


 [4.0K]  /data/pocs/aaa35ca92689e7db72ac57d39f189f8043c8fabd
├── [ 10K]  poc-cve.py
└── [2.4K]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!