{"id":2666,"date":"2025-03-18T10:05:11","date_gmt":"2025-03-18T10:05:11","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/03\/18\/critical-apache-tomcat-rce-vulnerability-exploited-in-just-30hrs-of-public-exploit\/"},"modified":"2025-03-18T10:05:11","modified_gmt":"2025-03-18T10:05:11","slug":"critical-apache-tomcat-rce-vulnerability-exploited-in-just-30hrs-of-public-exploit","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/03\/18\/critical-apache-tomcat-rce-vulnerability-exploited-in-just-30hrs-of-public-exploit\/","title":{"rendered":"Critical Apache Tomcat RCE Vulnerability Exploited in Just 30hrs of Public Exploit"},"content":{"rendered":"

Critical Apache Tomcat RCE Vulnerability Exploited in Just 30hrs of Public Exploit
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Security researchers have confirmed that a critical remote code execution (RCE) vulnerability in Apache Tomcat, tracked as CVE-2025-24813<\/a>, is being actively exploited in the wild.<\/p>\n

The vulnerability, which enables attackers to take control of servers with a simple PUT request, was disclosed last week, and proof-of-concept exploits were published on GitHub merely 30 hours later.<\/p>\n

The critical flaw affects multiple versions of Apache Tomcat: 11.0.0-M1 to 11.0.2, 10.1.0-M1 to 10.1.34, and 9.0.0.M1 to 9.0.98. First disclosed by Apache on March 10, 2025, the vulnerability allows attackers to view or inject arbitrary content on security-sensitive files under specific conditions.<\/p>\n

Wallarm security researchers have confirmed<\/a> active exploitation attempts, warning that traditional security tools fail to detect these attacks because the PUT requests appear normal and malicious content is obfuscated using base64 encoding.<\/p>\n

\n
\"\"<\/figure>\n<\/div>\n

Exploitation Mechanism<\/strong><\/h2>\n

The attack leverages Tomcat\u2019s default session persistence mechanism along with its support for partial PUT requests in a two-step process:<\/p>\n

Step 1: Uploading Malicious Code<\/strong><\/h3>\n

The attacker sends a PUT request containing a base64-encoded serialized Java payload, which gets saved to Tomcat\u2019s session storage. This request appears innocuous to most security filters, as the malicious payload is effectively hidden through encoding.<\/p>\n

Step 2: Triggering Execution<\/strong><\/h3>\n

Once the malicious file is uploaded, the attacker sends a GET request with a JSESSIONID cookie pointing to the uploaded session file. This forces Tomcat to deserialize and execute the malicious Java code, granting complete control to the attacker.<\/p>\n

\u201cThis attack is dead simple to execute and requires no authentication,\u201d explains Wallarm in their analysis. \u201cThe only requirement is that Tomcat is using file-based session storage, which is common in many deployments.\u201d<\/p>\n

Traditional Web Application Firewalls (WAFs) struggle to detect this attack for several reasons:<\/p>\n

    \n
  1. The initial PUT request looks normal without obvious malicious signatures<\/li>\n
  2. Base64 encoding enables the payload to bypass pattern-based detection<\/li>\n
  3. The attack unfolds in multiple steps, with execution occurring during deserialization<\/li>\n
  4. Most security tools don\u2019t deeply inspect uploaded files or track multi-step attacks.<\/li>\n<\/ol>\n

    User iSee857 created a GitHub<\/a> repository containing exploit code. The repository features a Python script that can check for vulnerability across multiple targets.<\/p>\n

    Mitigations<\/strong><\/h2>\n

    Apache recommends that all users upgrade to Tomcat versions 11.0.3+, 10.1.35+, or 9.0.99+, which contain patches for CVE-2025-24813<\/a>.<\/p>\n

    For organizations unable to update immediately, alternative mitigations include:<\/p>\n