aurorasec-pivot/cve-2025-55752基于 Docker 的重现环境，用于复现 Apache Tomcat 10.1.44 中的路径遍历漏洞 CVE-2025-55752。本实验场景可以复现官网报道的RCE
A Docker-based reproduction environment to reproduce the path traversal vulnerability CVE-2025-55752 in Apache Tomcat 10.1.44.
CVE-2025-55752 is a path traversal vulnerability in the RewriteValve component of Apache Tomcat, caused by improper URL normalization processing order: URL normalization occurs before URL decoding. This allows attackers to use URL-encoded path traversal sequences (such as ..%2f) to bypass security constraints and access protected directories (such as /WEB-INF/).
| Series | Affected Versions | Fixed Version |
|---|
| 11.x | 11.0.0-M1 to 11.0.10 | 11.0.11+ |
| 10.1.x | 10.1.0-M1 to 10.1.44 | 10.1.45+ |
| 9.0.x | 9.0.0-M11 to 9.0.108 | 9.0.109+ |
| 8.5.x | 8.5.6 to 8.5.100 | EOL - No patch |
git clone https://github.com/AuroraSec-Pivot/CVE-2025-55752.git
cd CVE-2025-55752
docker-compose up -d
Use the following URL path to test the path traversal vulnerability:
http://localhost:8080/rewrite/..%2fWEB-INF/web.xml
If the vulnerability exists, the protected /WEB-INF/web.xml file will be accessible.
docker-compose down
This vulnerability stems from the incorrect order of URL processing in the RewriteValve component:
This processing order allows attackers to use URL-encoded path traversal sequences (such as %2e%2e%2f or ..%2f) to bypass security checks and access resources that should be protected.
Upgrade to a fixed Tomcat version:
This environment is intended for educational purposes and security research only. Do not use it for illegal purposes. Users assume all risks; the author accepts no legal liability.