nuclei-CVE-2025-24813

This repository contains a yaml-template, to scan whether a Service may be vulnerable to CVE-2025-24813, without disrupting the server/causing any form of damage, using the vulnerability scanner nuclei.

CVE-2025-24813

CVE-2025-24813 is a vulnerability in the Apache Tomcat webserver from version 9.0.0-9.0.98, 10.1.0-10.1.34 and 11.0.0-11.0.2. It requires the Server to be configured to allow Write-Access via partial PUT and have persistent sessions enabled.

A potential Attack functions by writing to a file with an unexpected name making use of path equivalence via partial PUT to modify a saved Session file to contain malicious Java-Code. Attempting to interact with the server via the modified session then executes the inserted Java-code.

Scanning methodology

This template consists of three steps used to check if the Server is vulnerable:

• A GET-request, used to check the Server type and the version; This matcher only passes if the scanned Server is Apache Tomcat and its specified version is vulnerable. If the exact version-number is omitted, the matcher still passes.
• A PUT-request to test if writing to the server is possible. The request uses a Content-Range header to simulate partial PUT, without having to actually modify present files on the server. This matcher passes if the status-code of the response is 200, 201 or 204.
• A DELETE-request to get rid of the previously uploaded file, as to not leave any artifacts behind. This request does not have a matcher, as it is merely clean-up and not an actual indicator for the vulnerability

This test specifically does not check whether persistent sessions are enabled and session-files can be written to, as this might disrupt regular server business, and thus would move this template into Exploit territory, instead of being purely reconnaissance.