CVE-2025-24813

CVE-2025-24813

Apache Tomcat - Remote Code Execution via Session Deserialization

Unauthenticated partial PUT + path traversal + gadget-driven deserialization

Description

Apache Tomcat instances with the default servlet PUT enabled (readonly=false) allow writing files via HTTP PUT requests. By crafting a path that traverses out of the upload directory to the FileStore session storage location, an attacker can plant a crafted serialized Java object as a .session file. The next request that references this session triggers deserialization, executing the embedded gadget chain.

Preconditions

• Default servlet readonly=false in conf/web.xml
• org.apache.catalina.session.PersistentManager with FileStore configured in the webapp's META-INF/context.xml
• org.apache.commons.collections.enableUnsafeSerialization=true (or commons-collections < 3.2.2)
• PUT and path traversal are not filtered by a reverse proxy or WAF
• ysoserial.jar on the attacker machine

Usage

git clone https://github.com/yuzuki-ayanami/CVE-2025-24813
cd CVE-2025-24813
pip install -r requirements.txt

python cve-2025-24813.py http://target:8080 --ysoserial ysoserial.jar -c 'id'
python cve-2025-24813.py http://target:8080 --ysoserial ysoserial.jar -c 'whoami' --gadget CommonsCollections7

Requirements

• Python 3.8+
• requests
• ysoserial.jar
• Java (for running ysoserial)