U.S. CISA adds Apache Tomcat flaw to its Known Exploited Vulnerabilities catalog
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-24813 | Path Equivalence Flaw in Apache Tomcat Partial PUT Enables RCE and Disclosure Apache Tomcat is affected by a path equivalence flaw (CWE-44) in its handling of partial PUT requests, compounded by deserialization of untrusted data (CWE-502). A remote attacker triggers it by sending a crafted partial PUT (a PUT request with a Content-Range header) to a Tomcat instance that has write access enabled on its default servlet, causing uploaded content to be placed or reconstructed incorrectly and potentially leading to deserialization of attacker-controlled data. Successful exploitation can yield remote code execution, disclosure of sensitive information, or injection of malicious content, and CISA notes the flaw can be chained with CVE-2026-34486. Any organization running Apache Tomcat is potentially affected (version ranges were not specified in the provided data), with risk concentrated in deployments that permit PUT uploads and use file-based session persistence in default locations. Exploitation is confirmed in the wild: the CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2025-04-01 and EPSS assigns a 99.9% probability of exploitation within 30 days, though no public proof-of-concept is known. Do: Apply the vendor mitigation per CISA's required action: upgrade Tomcat to the fixed release identified in Apache's security advisory for this CVE, or, if patching is not immediately possible, disable write access (readonly) on the default servlet/restrict partial PUT and move file-based session storage away from default locations. Federal agencies must follow BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Audit Tomcat instances (including embedded deployments) for write-enabled PUT and file-based session persistence, and consider exposure to chaining with CVE-2026-34486. | 9.8 | 100% | KEV PoC ×3 |
| mass≥100,000 directly internet-exposed Tomcat instances, out of millions of total deployments worldwide |
Full article674 words · extracted from securityaffairs.com · click to collapse
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apache Tomcat flaw to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an Apache Tomcat path equivalence vulnerability, tracked as CVE-2025-24813, to its Known Exploited Vulnerabilities (KEV) catalog.
The Apache Tomcat vulnerability CVE-2025-24813 was recently disclosed and is being actively exploited just 30 hours after a public PoC was released.
The issue is a path equivalence flaw in Apache Tomcat that allows remote code execution or information disclosure if specific conditions are met. The vulnerability affects multiple versions including 11.0.0-M1 to 11.0.2, 10.1.0-M1 to 10.1.34, and 9.0.0.M1 to 9.0.98. Exploitation requires write-enabled default servlet, partial PUT support, and specific file handling conditions.
“The original implementation of partial PUT used a temporary file based on the user provided file name and path with the path separator replaced by “.”.” reads the advisory.
“If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:
- writes enabled for the default servlet (disabled by default)
- support for partial PUT (enabled by default)
- a target URL for security sensitive uploads that is a sub-directory of a target URL for public uploads
- attacker knowledge of the names of security sensitive files being uploaded
- the security sensitive files also being uploaded via partial PUT
If all of the following were true, a malicious user was able to perform remote code execution:
- writes enabled for the default servlet (disabled by default)
- support for partial PUT (enabled by default)
- application was using Tomcat’s file based session persistence with the default storage location
- application included a library that may be leveraged in a deserialization attack”
Tomcat versions 9.0.99, 10.1.35, and 11.0 addressed the vulnerability.
Wallarm researchers confirmed active exploitation of the flaw and added that attackers can hijack Apache Tomcat servers with a single PUT API request. PoC is online.
“A devastating new remote code execution (RCE) vulnerability, CVE-2025-24813, is now actively exploited in the wild. ” reads the advisory published by Wallarm. “Attackers need just one PUT API request to take over vulnerable Apache Tomcat servers. The exploit, originally published by a Chinese forum user iSee857, is already available online: CVE-2025-24813 PoC by iSee857.”
The attack exploits Tomcat’s session persistence and partial PUT requests by uploading a malicious Java session file and triggering deserialization via a GET request.
The attack involves two steps:
- Uploading a Malicious Serialized Session – The attacker sends a PUT request containing a base64-encoded ysoserial gadget chain, storing it in Tomcat’s session directory.
- Triggering Execution via Session Cookie – A GET request with the JSESSIONID referencing the malicious session forces Tomcat to deserialize and execute the payload, granting remote access.
“This attack is dead simple to execute and requires no authentication. The only requirement is that Tomcat is using file-based session storage, which is common in many deployments.” concludes the advisory. “Worse, base64 encoding allows the exploit to bypass most traditional security filters, making detection challenging.”
Wallarm researchers warn that most Web Application Firewalls (WAFs) fail to detect this attack because the PUT request appears normal and lacks obvious malicious content. The payload is base64-encoded, evading pattern-based detection, and the attack occurs in two steps, with execution happening only during deserialization. Additionally, most WAFs do not thoroughly inspect uploaded files or track multi-step exploits. As a result, by the time organizations notice the breach in their logs, it is already too late.
Users are recommended to update their affected Tomcat versions immediately to mitigate potential threats.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix this vulnerability by April 22, 2025.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/176129/security/u-s-cisa-adds-apache-tomcat-flaw-known-exploited-vulnerabilities-catalog.html