TomcatScanner

Advanced Detection and Exploitation Tool for CVE-2025-24813

TomcatScanner is a comprehensive security tool designed for detecting and exploiting the CVE-2025-24813 vulnerability in Apache Tomcat servers. This vulnerability involves a path equivalence issue in the 'file.Name' parameter that can lead to remote code execution (RCE).

Table of Contents

• Features
• Installation
• Usage
  • Basic Scanning
  • Advanced Options
  • Exploitation Mode
• Examples
• Creating a Wordlist
• Output Interpretation
• CVE-2025-24813 Explanation
• Legal Disclaimer
• Contributing
• License

Features

• Comprehensive Detection: Tests multiple paths for the vulnerability with customizable wordlists
• Multithreaded Operation: Efficiently scans targets with parallel processing
• Session Manipulation: Performs advanced exploitation using session manipulation techniques
• Exploit Mode: Not just detection - can actively exploit the vulnerability to confirm its presence
• Detailed Reporting: Provides comprehensive scan results with color-coded output
• Multiple Target Support: Scan a single target or multiple targets from a list file
• Result Storage: Save vulnerable targets to an output file for later processing

Installation

Prerequisites

• Python 3.6 or higher
• Required Python packages

Step 1: Clone the repository

git clone https://github.com/yourusername/tomcat-scanner.git
cd tomcat-scanner

Step 2: Install dependencies

pip install -r requirements.txt

The requirements.txt file should include:

requests>=2.28.0
urllib3>=1.26.0

Step 3: Create a wordlist

Create a file named wordlist.txt with paths to test for the vulnerability or use the provided sample wordlist.

Usage

Basic Scanning

Scan a single target:

python tomcat_scanner.py -u http://example.com:8080

Scan multiple targets from a file:

python tomcat_scanner.py -l targets.txt

Advanced Options

usage: tomcat_scanner.py [-h] [-u URL] [-l LIST] [-w WORDLIST] [-t THREADS]
                        [-o OUTPUT] [--timeout TIMEOUT] [--ssl-verify]
                        [-v] [--exploit] [--command COMMAND]

Scanner for CVE-2025-24813 vulnerability in Apache Tomcat

optional arguments:
  -h, --help            show this help message and exit
  -u URL, --url URL     Single target URL (e.g., http://example.com:8080)
  -l LIST, --list LIST  File containing a list of target URLs
  -w WORDLIST, --wordlist WORDLIST
                        Wordlist file containing paths to test (default: wordlist.txt)
  -t THREADS, --threads THREADS
                        Number of parallel threads (default: 10)
  -o OUTPUT, --output OUTPUT
                        Output file for results
  --timeout TIMEOUT     Request timeout in seconds (default: 5)
  --ssl-verify          Verify SSL certificates
  -v, --verbose         Enable verbose mode with HTTP response codes
  --exploit             Attempt to exploit vulnerable targets
  --command COMMAND     Test command for exploit mode (default: echo CVE-2025-24813)

Exploitation Mode

To not only detect but also exploit the vulnerability:

python tomcat_scanner.py -u http://vulnerable-server.com:8080 --exploit

Specify a custom command to execute during exploitation:

python tomcat_scanner.py -u http://vulnerable-server.com:8080 --exploit --command "whoami"

Examples

Basic Scan

python tomcat_scanner.py -u http://example.com:8080 -w my_wordlist.txt

Verbose Scan with Multiple Threads

python tomcat_scanner.py -u http://example.com:8080 -t 20 -v

Scan Multiple Targets and Save Results

python tomcat_scanner.py -l target_list.txt -o vulnerable_targets.txt

Full Exploitation Scan

python tomcat_scanner.py -u http://example.com:8080 --exploit --command "id" -v --timeout 10

Creating a Wordlist

TomcatScanner requires a wordlist of paths to test. The wordlist should contain potential vulnerable paths, one per line.

Example wordlist entries:

/path/uploads/file.name
/webapps/manager/file.name
/tomcat/manager/uploads/file.name
/uploads/../sessions/absholi7ly.session

Output Interpretation

The tool provides color-coded output to easily identify important information:

• Green: Successful requests and non-vulnerable targets
• Red: Error messages and vulnerable targets
• Yellow: Failed requests and warnings
• Blue: Informational messages
• Purple: Headers and summary sections

Scan Summary

At the end of each scan, the tool displays a summary with:

1. Total scan time
2. Number of paths tested
3. Successful, failed, and error requests
4. Distribution of HTTP response codes
5. Vulnerable URLs detected
6. Exploitation success rate (if in exploit mode)

CVE-2025-24813 Explanation

CVE-2025-24813 affects Apache Tomcat and involves a path equivalence vulnerability in how the application handles the 'file.Name' parameter. This vulnerability can allow attackers to:

1. Upload files to unintended directories using path traversal
2. Potentially achieve remote code execution by manipulating session files
3. Bypass intended access controls

The vulnerability typically manifests when a PUT request is allowed to write to a path containing "file.name" or when path traversal is possible through a partial PUT operation.

Legal Disclaimer

THIS TOOL IS PROVIDED FOR EDUCATIONAL AND ETHICAL TESTING PURPOSES ONLY.

Usage of TomcatScanner for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state, and federal laws. The developers assume no liability and are not responsible for any misuse or damage caused by this program.

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

Steps to contribute:

1. Fork the repository
2. Create a feature branch (git checkout -b feature/amazing-feature)
3. Commit your changes (git commit -m 'Add amazing feature')
4. Push to the branch (git push origin feature/amazing-feature)
5. Open a Pull Request

License

This project is licensed under the MIT License - see the LICENSE file for details.

MIT License

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files...