CVE-2025-24813 — Apache Tomcat

Key facts

CVE-2025-24813 (Apache Software Foundation) is a Critical vulnerability: Apache Tomcat. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2025-04-01), confirming active exploitation in the wild.

Actively exploited — on the CISA KEV catalog

CVE-2025-24813 is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2025-04-01), confirming exploitation in the wild. Federal remediation deadline: 2025-04-22. Prioritise patching and deploy the detection and prevention rules below.

CVE	CVE-2025-24813
Severity	Critical
CISA KEV	Actively exploited (added 2025-04-01)
Vendor	Apache Software Foundation
Product	Apache Tomcat
Detection / prevention	Snort, YARA, Nginx, Apache
PoC	poc.py
Source	2025/CVE-2025-24813/

Details

CVE-2025-24813 (Apache Software Foundation) is a Critical vulnerability: Apache Tomcat. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

Apache Tomcat - Path Equivalence RCE

Overview

Field	Value
CVE ID	CVE-2025-24813
Severity	Critical (CVSS 9.8)
Vendor	Apache Software Foundation
Product	Apache Tomcat
Vulnerability Type	Path Equivalence / RCE
Exploitation	Remote, No Authentication

Description

Apache Tomcat contains a path equivalence vulnerability that allows remote attackers to bypass security constraints and achieve remote code execution. The vulnerability exists in the handling of partial PUT requests and session persistence, allowing attackers to upload and execute arbitrary files.

Affected Versions

• Apache Tomcat 11.0.0-M1 to 11.0.2
• Apache Tomcat 10.1.0-M1 to 10.1.34
• Apache Tomcat 9.0.0-M1 to 9.0.98

Impact

• Remote Code Execution
• Security constraint bypass
• Arbitrary file upload
• Web application compromise
• Server takeover

Verification Process

The PoC uses a multi-stage verification approach:

Step 1: Product/Version Detection (Passive)

[*] Query target endpoint
[*] Detect product signatures and extract version
[*] Check if version is in vulnerable range

Step 2: Active Vulnerability Testing

Method	Description	Detection
Error-based	Tests for error messages indicating vulnerability	Error indicators in response
Timing-based	Measures response delay with payload	Response time significantly longer
Response-based	Checks for expected patterns in response	Vulnerability indicators present

Verification Flow

┌─────────────────────────────────────────────────────────────┐
│                    Product Detection                         │
│  Query target → Detect product/version                      │
│  Check if version in vulnerable range                       │
└─────────────────────────────────────────────────────────────┘
                              ↓
┌─────────────────────────────────────────────────────────────┐
│               Active Vulnerability Testing                   │
│                                                              │
│  1. Error-based Test                                         │
│     └─ Send payload → Check for error indicators            │
│     └─ If error found → CONFIRMED VULNERABLE                │
│                                                              │
│  2. Timing-based Test                                        │
│     └─ Send delay payload → Measure response time           │
│     └─ If delayed → CONFIRMED VULNERABLE                    │
│                                                              │
│  3. Response-based Test                                      │
│     └─ Send payload → Check response content                │
│     └─ If pattern matches → CONFIRMED VULNERABLE            │
└─────────────────────────────────────────────────────────────┘

Usage

# Full vulnerability check (version + active testing)
python3 poc.py -t https://target.com -c

# Version-only check (passive, no payloads sent)
python3 poc.py -t https://target.com -c --version-only

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-24813
• https://tomcat.apache.org/security.html

Disclaimer

This POC is for educational and authorized security testing only.

Detection and prevention

Ready-to-deploy defensive rules for CVE-2025-24813, for authorized testing and blue-team detection engineering:

• Snort IDS signature — prevention/snort.rules
• YARA detection rule — prevention/yara.yar
• Nginx mitigation — prevention/nginx.conf
• Apache HTTPD mitigation — prevention/httpd.conf
• Rule notes — prevention/README.md

References: NVD — CVE-2025-24813 · full write-up on the searchable site

Detection & prevention rules

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

# CVE-2025-24813 - Apache Tomcat Snort Detection Rules
# Severity: Critical (CVSS 9.8)

# Detect partial PUT request
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-24813 Tomcat Partial PUT Request";
    flow:to_server,established;
    content:"PUT"; http_method;
    content:"Content-Range"; http_header;
    classtype:web-application-attack;
    sid:2025248131;
    rev:1;
    metadata:cve CVE-2025-24813, severity critical;
)

# Detect path equivalence bypass
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-24813 Tomcat Path Equivalence Bypass";
    flow:to_server,established;
    content:"..;"; http_uri;
    classtype:web-application-attack;
    sid:2025248132;
    rev:1;
    metadata:cve CVE-2025-24813, severity critical;
)

# Detect session directory access
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-24813 Tomcat Session Directory Access";
    flow:to_server,established;
    content:"PUT"; http_method;
    content:"/sessions/"; http_uri;
    classtype:web-application-attack;
    sid:2025248133;
    rev:1;
    metadata:cve CVE-2025-24813, severity critical;
)

# Detect JSP upload via PUT
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-24813 Tomcat JSP PUT Upload";
    flow:to_server,established;
    content:"PUT"; http_method;
    content:".jsp"; http_uri;
    classtype:web-application-attack;
    sid:2025248134;
    rev:1;
    metadata:cve CVE-2025-24813, severity critical;
)

# Detect serialized Java in PUT body
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-24813 Serialized Java in PUT";
    flow:to_server,established;
    content:"PUT"; http_method;
    content:"|AC ED 00 05|";
    classtype:web-application-attack;
    sid:2025248135;
    rev:1;
    metadata:cve CVE-2025-24813, severity critical;
)

:material-file-download: prevention/snort.rules

/*
 * CVE-2025-24813 - Apache Tomcat Path Equivalence YARA Rules
 * Severity: Critical (CVSS 9.8)
 */

rule CVE_2025_24813_Exploit_Request {
    meta:
        description = "Detects CVE-2025-24813 Tomcat exploitation requests"
        author = "Security Research"
        date = "2025-03-10"
        cve = "CVE-2025-24813"
        severity = "critical"

    strings:
        // HTTP PUT method
        $put = "PUT " ascii wide

        // Path equivalence patterns
        $path1 = "..;" ascii wide
        $path2 = ";/" ascii wide
        $path3 = "%2e%2e%3b" ascii wide nocase
        $path4 = "/../" ascii wide

        // Content-Range header
        $range = "Content-Range:" ascii wide nocase

        // Target paths
        $target1 = "/sessions/" ascii wide
        $target2 = ".session" ascii wide
        $target3 = ".jsp" ascii wide

    condition:
        $put and ($range or any of ($path*)) and any of ($target*)
}

rule CVE_2025_24813_Serialized_Payload {
    meta:
        description = "Detects serialized Java payloads for Tomcat exploitation"
        author = "Security Research"
        date = "2025-03-10"
        cve = "CVE-2025-24813"
        severity = "critical"

    strings:
        // Java serialization header
        $java_serial = { AC ED 00 05 }

        // Common gadget classes
        $gadget1 = "org.apache.commons.collections" ascii wide
        $gadget2 = "com.sun.org.apache.xalan" ascii wide
        $gadget3 = "java.lang.Runtime" ascii wide

        // Tomcat session markers
        $session1 = "org.apache.catalina.session" ascii wide
        $session2 = "StandardSession" ascii wide

    condition:
        $java_serial and (any of ($gadget*) or any of ($session*))
}

rule CVE_2025_24813_JSP_Webshell {
    meta:
        description = "Detects JSP webshells uploaded via CVE-2025-24813"
        author = "Security Research"
        date = "2025-03-10"
        cve = "CVE-2025-24813"
        severity = "critical"

    strings:
        // JSP markers
        $jsp1 = "<%@ page" ascii wide nocase
        $jsp2 = "<%" ascii wide

        // Dangerous functions
        $func1 = "Runtime.getRuntime()" ascii wide
        $func2 = "ProcessBuilder" ascii wide
        $func3 = "exec(" ascii wide
        $func4 = "getParameter" ascii wide

        // Common webshell patterns
        $shell1 = "cmd" ascii wide
        $shell2 = "command" ascii wide

    condition:
        any of ($jsp*) and 2 of ($func*) and any of ($shell*)
}

rule CVE_2025_24813_Network_IOC {
    meta:
        description = "Network indicators for CVE-2025-24813 exploitation"
        author = "Security Research"
        date = "2025-03-10"
        cve = "CVE-2025-24813"
        severity = "high"

    strings:
        // HTTP request patterns
        $http1 = "PUT /..;" ascii wide
        $http2 = "PUT /sessions/" ascii wide
        $http3 = /PUT [^\r\n]*\.jsp/ ascii

        // Headers
        $hdr1 = "Content-Range: bytes" ascii wide nocase

        // Tomcat indicators
        $tomcat1 = "Apache-Coyote" ascii wide
        $tomcat2 = "Apache Tomcat" ascii wide

    condition:
        any of ($http*) and ($hdr1 or any of ($tomcat*))
}

:material-file-download: prevention/yara.yar

# CVE-2025-24813 - Apache Tomcat Prevention Rules for Nginx

# Block PUT method (if not needed)
location / {
    limit_except GET POST HEAD {
        deny all;
    }
}

# Block path traversal patterns
location ~* (\.\.|%2e%2e|\.%00|%00\.) {
    return 403;
}

# Block partial PUT requests
if ($http_content_range) {
    return 403;
}

# Block access to session directories
location ~* /sessions/ {
    deny all;
}

# Block JSP direct uploads
location ~* \.jsp$ {
    if ($request_method = PUT) {
        return 403;
    }
}

# Block path equivalence bypass patterns
location ~* /\.\.;/ {
    return 403;
}

location ~* ;/ {
    return 403;
}

# Rate limiting for PUT requests
limit_req_zone $binary_remote_addr zone=put_limit:10m rate=5r/m;

location / {
    if ($request_method = PUT) {
        set $put_request 1;
    }
    limit_req zone=put_limit burst=2 nodelay;
}

:material-file-download: prevention/nginx.conf

# CVE-2025-24813 - Apache Tomcat Prevention Rules for Apache HTTPD

# Block PUT method globally
<LimitExcept GET POST HEAD>
    Require all denied
</LimitExcept>

# ModSecurity Rules
<IfModule mod_security2.c>
    # Block partial PUT requests
    SecRule REQUEST_METHOD "@streq PUT" \
        "id:2025248131,phase:1,chain,deny,status:403,\
        msg:'CVE-2025-24813 Partial PUT Request Blocked'"
        SecRule REQUEST_HEADERS:Content-Range "!^$" ""

    # Block path traversal patterns
    SecRule REQUEST_URI "@rx (\.\.|%2e%2e|\.;)" \
        "id:2025248132,phase:1,deny,status:403,\
        msg:'CVE-2025-24813 Path Traversal Blocked',\
        severity:CRITICAL"

    # Block Tomcat path equivalence bypass
    SecRule REQUEST_URI "@rx ;/" \
        "id:2025248133,phase:1,deny,status:403,\
        msg:'CVE-2025-24813 Path Equivalence Bypass Blocked',\
        severity:CRITICAL"

    # Block JSP upload via PUT
    SecRule REQUEST_URI "@rx \\.jsp$" \
        "id:2025248134,phase:1,chain,deny,status:403,\
        msg:'CVE-2025-24813 JSP PUT Upload Blocked'"
        SecRule REQUEST_METHOD "@streq PUT" ""

    # Block session file manipulation
    SecRule REQUEST_URI "@contains /sessions/" \
        "id:2025248135,phase:1,deny,status:403,\
        msg:'CVE-2025-24813 Session Directory Access Blocked',\
        severity:CRITICAL"
</IfModule>

# Block Content-Range header for PUT
RewriteEngine On
RewriteCond %{REQUEST_METHOD} PUT
RewriteCond %{HTTP:Content-Range} .+
RewriteRule ^ - [F,L]

:material-file-download: prevention/httpd.conf

Frequently asked questions

What is CVE-2025-24813?

CVE-2025-24813 (Apache Software Foundation) is a Critical vulnerability: Apache Tomcat. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2025-04-01), confirming active exploitation in the wild.

How do I detect CVE-2025-24813?

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2025-24813?

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

Is CVE-2025-24813 actively exploited?

Yes. CVE-2025-24813 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, added 2025-04-01, which means it has been exploited in the wild. CISA set a federal remediation deadline of 2025-04-22. Prioritise patching and deploy the detection and prevention rules above.

Related CVEs

Other entries for the same vendor or product:

• CVE-2026-44930 — Apache CXF (Critical (9.8))
• CVE-2025-55752 — Apache Tomcat Directory Traversal RCE (High (8.6))
• CVE-2024-24549 — Apache Tomcat HTTP/2 DoS (High (7.5))
• CVE-2024-45387 — Apache Traffic Server (High)

---

For authorized security testing and research only. See the full source and NVD record.