Hack Forums
[Legends] Major Apache Tomcat Vulnerability RCE CVE-2025-24813 - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: White Hat Hacking (https://hackforums.net/forumdisplay.php?fid=400)
+---- Thread: [Legends] Major Apache Tomcat Vulnerability RCE CVE-2025-24813 (/showthread.php?tid=6294055)

Major Apache Tomcat Vulnerability RCE CVE-2025-24813 - JoseMar - Mar 11, 2025

Major Apache Tomcat Vulnerability RCE
CVE-2025-24813

[Image: Screenshot-1.png]

A basic security blemish has been found in Apache Tomcat, putting servers at genuine hazards of inaccessible code execution (RCE), information debasement, and data spills. If you're running Tomcat, please take care of this immediately.

What’s the Issue?
The powerlessness comes from how Tomcat handles halfway HTTP PUT requests, including permitting clients to transfer records in chunks. The issue? The unique code (presently fixed) didn’t handle filenames legitimately, making an opening for assailants to:
  • Bypass security controls – Trap the server into composing records exterior permitted directories.
  • Inject noxious substance – Overwrite existing JSP records or setups, driving to further code execution.
  • Expose touchy information – Pick up limited records through way traversal exploits.
Who’s Affected?
You're defenseless if you utilize Tomcat forms 11.0.0-M1 to 11.0.2, 10.1.0-M1 to 10.1.34, or 9.0.0.M1 to 9.0.98.

The great news? Apache has discharged fixed versions:
  1. Tomcat 11.0.3
  2. Tomcat 10.1.35
  3. Tomcat 9.0.98
Upgrading is the best way to get near this security hole.

How hackers can abuse ahis
To drag off an assault, programmers see for particular conditions, such as:
  • Write get to the default servlet (not default, but misconfigurations happen).
  • Partial PUT back empowered (this is on by default).
  • File-based session capacity (which can be manipulated).
  • A powerless deserialization library (common in Java apps).

Once interior, a hacker can:
  • Tamper with session records to alter client data.
  • Upload malevolent JSP records to execute code remotely.
  • Expose arrangement records that may contain qualifications or inner settings.

What You Ought to Do Right Now
  1. Upgrade quickly – Introduce Tomcat 11.0.3, 10.1.35, or 9.0.98.
  2. Impair halfway PUT if you can’t update – Set allowPartialPut="false" in your DefaultServlet config.
  3. Guarantee readonly=true in the default servlet to piece unauthorized writes.
  4. Review your conditions – Expel obsolete libraries powerless to deserialization attacks.
  5. For Java 17 clients: Include -Dsun.io.useCanonCaches=false to maintain a strategic distance from filename cache issues.
Security Specialists Are Encouraging Action
Mark Thomas from the Apache Tomcat Security Group warns:
  • “This powerlessness underscores the dangers of combining write-enabled servlets with case-insensitive filesystems.”

Don´t forget to update and stay safe!🕵️

Additional sources to explore: You can also search directly by CVE on Google for more information:

RE: Major Apache Tomcat Vulnerability RCE CVE-2025-24813 - Pr0m3th3us - Mar 12, 2025

Bro where do you find all this lol legit shit