dhananjayasj/cve-2025-24813-apache-tomcat-partial-put-deserialization-rce-Proof-of-concept exploit for CVE-2025-24813, an unauthenticated RCE in Apache Tomcat via partial PUT and deserialization. Includes Docker lab for testing.
CVE-2025-24813 is a high‑severity vulnerability in Apache Tomcat that allows unauthenticated remote code execution when three conditions are met:
readonly=false).PersistentManager with FileStore).An attacker can upload a malicious serialized Java object via a partial PUT request (using the Content-Range header) into the session storage directory. By then sending a GET request with a crafted cookie, Tomcat deserialises the object and executes arbitrary commands (provided a deserialisation gadget – e.g., – is present in the classpath).
JSESSIONIDcommons-collections⚠️ Important
This vulnerability is not present in a default Tomcat installation. It requires specific (and unusual) configuration changes that are typically found only in development or bespoke environments.
Earlier versions may also be vulnerable if the same misconfigurations exist.
pip (for requests library)ysoserial)netcat (nc)curlgit clone https://github.com/beyond-devsecops/CVE-2025-24813.git
cd CVE-2025-24813
chmod +x 0-run-tomcat.sh
bash 0-run-tomcat.sh