CVE-2025-48799 – Apache Tomcat Remote Code Execution (PoC)

This repository contains a proof-of-concept exploit for CVE-2025-48799, a remote code execution vulnerability discovered in Apache Tomcat 9.0.48. The flaw stems from an integer overflow in the HTTP header parser, which can be triggered by a specially crafted X-Forwarded header.

---

Purpose

This project was created for educational and research purposes only. It demonstrates:

• How malformed HTTP headers can lead to memory corruption
• Techniques for crafting shellcode and calculating buffer offsets
• A practical example of exploiting a real-world patched CVE in a controlled environment

---

How It Works

The exploit:

1. Constructs an oversized X-Forwarded header to trigger an integer overflow
2. Injects shellcode into the corrupted memory region
3. Sends the payload using libcurl to a vulnerable Tomcat instance

---

Ethical Disclaimer

This code is intended strictly for educational use in lab environments. Do not deploy or test this exploit on systems you do not own or have explicit permission to audit. I support responsible disclosure and ethical hacking practices.