Apache-Tomcat-CVE-2025-24813-Lab

CVE-2025-24813: Apache Tomcat Detection & Mitigation Lab

A defensive cybersecurity portfolio project demonstrating vulnerability research, detection engineering, log correlation, layered mitigation, and technical documentation in an isolated two-VM environment.

Project summary

This repository documents an authorised university laboratory investigation of CVE-2025-24813, an Apache Tomcat vulnerability involving the write-enabled Default Servlet and partial PUT handling. Under a specific combination of unsafe configuration and application conditions, the issue can lead to information disclosure, modification of uploaded files, or remote code execution through session deserialisation.

The project focuses on the defender's workflow:

Build an isolated and reproducible virtual test environment.

• Observe suspicious web, network, and host activity.

• Detect activity using Suricata, Splunk, Tomcat access logs, and auditd.

• Correlate multiple telemetry sources to increase confidence.

• Apply Tomcat hardening, host firewall controls, least privilege, and IDS/IPS controls.

• Retest and document the difference between the exposed and secured states.

• No malicious payloads, reverse shells, weaponised exploit scripts, or third-party exploit binaries are included.

Lab architecture

flowchart LR subgraph VBOX[Isolated VirtualBox NAT Network] VM1[VM1 - Security Workstation\n192.168.1.17\nUbuntu\nSplunk Enterprise\nAuthorised validation tools] VM2[VM2 - Tomcat Server\n192.168.1.19\nUbuntu\nApache Tomcat 10.1.16\nSuricata + auditd + UFW\nSplunk Universal Forwarder] VM1 -->|Lab HTTP traffic :8080| VM2 VM2 -->|Tomcat, Suricata and audit logs| VM1 end