Apache Tomcat CVE-2025-24813 Local Reproduction Record

For local authorized experiments, patch understanding, and defensive validation only. Do not send requests to unauthorized targets.

This project records the reproduction process of CVE-2025-24813 on a local Apache Tomcat 9.0.98 instance: using partial PUT to write temporary files, and under a configuration with file-based Session persistence enabled and loose deserialization filtering conditions, verifying the Session file loading and Payload execution chain.

Summary of Conclusions

• Tested version: Apache Tomcat 9.0.98 (screenshots and local experiment records)
• Fixed version: Apache Tomcat 9.0.99
• Key prerequisites: Default Servlet write capability enabled, partial PUT available, file-based Session persistence using the default location, and an exploitable deserialization library present in the application classpath.
• This experiment first confirms that .inject.session is successfully written in the working directory, then confirms that access triggers Session loading and Payload execution; success cannot be judged solely by HTTP status codes.
• Some experiment requests return 409 or 500, but file writing and subsequent triggering still need to be judged in stages based on file contents, server logs, and controlled side effects.

The official Apache security advisory lists the trigger prerequisites, affected scope (Tomcat 9.0.0-M1 to 9.0.98), and 9.0.99 fix information for CVE-2025-24813: https://tomcat.apache.org/security-9

Experiment Environment

• Apache Tomcat 9.0.98
• Java 17 (the actual runtime version on the experiment machine is subject to java -version)
• Linux
• Python 3, requests
• Listening only on local 127.0.0.1:8080

Directory Structure

scripts/reproduce_local.py       # Local validation script, target defaults to localhost:8080
evidence/                         # Experiment screenshots (renamed by step)

How to Run

python3 -m venv .venv
. .venv/bin/activate
python -m pip install requests
python scripts/reproduce_local.py

The target in the script is fixed to the local experiment address and does not include remote scanning logic. Before running, confirm in the local Tomcat instance:

1. The Default Servlet write capability is enabled according to the experiment configuration;
2. File-based Session persistence is enabled;
3. The target application contains the class libraries required for the experiment;
4. The server log directory and work/Catalina/localhost/ROOT are observable.

Validation Points

1. PUT /inject/session carries Content-Range, observe whether a temporary file is generated;
2. Check the size and content of work/Catalina/localhost/ROOT/.inject.session;
3. Use JSESSIONID=.inject to access a controlled local page, observe Session file loading;
4. Confirm whether the Payload is executed by combining Tomcat logs and experiment side effects;
5. Record HTTP responses, file status, and log results separately, to avoid directly treating 409/500 as either failure or success of vulnerability reproduction.

Notes on Request Format

HTTP headers must use real CRLF (bytes 0d 0a); do not send 0x0d0x0a as visible text. In Python, use b"\\r\\n" or let requests construct the request headers.

Protection and Fix Validation

Prioritize upgrading to a Tomcat version that includes the fix, and re-check Default Servlet write permissions, partial PUT usage scenarios, and Session persistence filter configuration. After the fix, repeat the same set of local validation steps; it is expected that the temporary file write chain or the Session loading chain will no longer hold.

Disclaimer

This repository does not provide scanning, persistence, or batch exploitation functionality targeting internet-facing targets. All content is limited to local experiment environments under my own control and explicitly authorized ranges.