CVE-2025-24813 PoC — Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Source

https://github.com/Mattb709/CVE-2025-24813-Scanner

Associated Vulnerability

Title:Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)
Description:Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads - attacker knowledge of the names of security sensitive files being uploaded - the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - application was using Tomcat's file based session persistence with the default storage location - application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.

Description

CVE-2025-24813-Scanner is a Python-based vulnerability scanner that detects Apache Tomcat servers vulnerable to CVE-2025-24813, an arbitrary file upload vulnerability leading to remote code execution (RCE) via insecure PUT method handling and jsessionid exploitation.

Readme

## CVE-2025-24813 Scanner

A multi-threaded vulnerability scanner to detect Apache Tomcat servers vulnerable to CVE-2025-24813 (arbitrary file upload leading to RCE).

![Python Version](https://img.shields.io/badge/python-3.6%2B-blue)
![License](https://img.shields.io/badge/license-MIT-green)

## Description

This scanner checks for Apache Tomcat servers vulnerable to CVE-2025-24813 by:
1. Attempting to upload a serialized Java object via HTTP PUT
2. Verifying if the uploaded file can be executed via jsessionid parameter

Features:
- Multi-threaded scanning (adjustable thread count)
- CSV input/output support
- Color-coded terminal output
- Detailed vulnerability verification
- Graceful interruption handling

## Installation

```bash
git clone https://github.com/yourusername/CVE-2025-24813-Scanner.git
cd CVE-2025-24813-Scanner
pip install -r requirements.txt
```

## Usage

### Basic Scan
```bash
python CVE-2025-24813-Scanner.py -f targets.csv
```

### Full Options
```bash
python CVE-2025-24813-Scanner.py \
  -f targets.csv \          # Input CSV with host,ip,port columns
  -o vulnerable_hosts.csv \ # Save vulnerable targets
  -t 10 \                   # Use 10 threads
```

### Example Scenarios

1. Quick scan with default settings:
```bash
python CVE-2025-24813-Scanner.py -f network_hosts.csv
```

2. Comprehensive scan with output:
```bash
python CVE-2025-24813-Scanner.py -f production.csv -o results.csv -t 15
```

## Sample Output

```plaintext
[*] Apache Tomcat CVE-2025-24813 Scanner

[*] Scanning https://example.com:8443...
[+] https://example.com:8443 is vulnerable to CVE-2025-24813!

[*] Scanning http://testserver:8080...
[-] http://testserver:8080 is not vulnerable (PUT failed: 401).

[*] Scanning http://192.168.1.15:8080...
[!] http://192.168.1.15:8080 allows PUT but no RCE (GET: 404).

[*] Scan Complete
[+] Vulnerable: 1
[-] Not Vulnerable: 2
[+] Vulnerable IPs:
    https://example.com:8443
```

## Requirements

- Python 3.6+
- Packages:
  - `requests>=2.25.1`
  - `pandas>=1.2.0`
  - `colorama>=0.4.4`

## License

MIT License - See [LICENSE](LICENSE) for details.

## Disclaimer

This tool is for authorized security testing and educational purposes only. Never scan systems without explicit permission. The author accepts no liability for misuse of this software.

File Snapshot


 [4.0K]  /data/pocs/cbbaff0a873a3e5f2021b6ab069bb9800653e34d
├── [5.3K]  CVE-2025-24813-Scanner.py
├── [1.0K]  LICENSE
├── [2.3K]  README.md
└── [ 172]  requirements.txt

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!