Full Report
By simply sending HTTP requests, attackers can trigger the deserialisation of malicious data in Tomcat's session storage and gain control.
Analysis Summary
# Vulnerability: Critical RCE in Apache Tomcat via Session Deserialization
## CVE Details
- CVE ID: CVE-2025-24813
- CVSS Score: Not explicitly stated, but described as "Critical" and leading to RCE.
- CWE: Likely related to Deserialization of Untrusted Data (CWE-502)
## Affected Systems
- Products: Apache Tomcat
- Versions: Specific vulnerable versions were not detailed in the provided excerpt but are addressed in the vendor's security note.
- Configurations: Affects systems utilizing Tomcat's session storage mechanism for data processing. No authentication is required.
## Vulnerability Description
This is a critical vulnerability allowing Remote Code Execution (RCE) solely through the sending of crafted HTTP requests. The exploitation mechanism involves two steps:
1. **Insertion:** The attacker sends a `PUT` request containing a base64-encoded, serialized Java payload which is written into Tomcat's session storage and saved to a file.
2. **Execution:** The attacker then sends a `GET` request with a specific `JSESSIONID` cookie pointing to the malicious session. Tomcat processes this request, deserializes the session data without proper validation, and executes the embedded malicious Java code, granting the attacker remote control.
## Exploitation
- Status: Actively exploited in the wild. A Proof of Concept (PoC) was released on GitHub shortly after disclosure.
- Complexity: Low. Exploitation relies on standard HTTP requests.
- Attack Vector: Network (Remote).
## Impact
- Confidentiality: High (Potential full system access).
- Integrity: High (Potential modification/destruction of data via RCE).
- Availability: High (Potential system compromise/disruption).
## Remediation
### Patches
- Specific patch versions listed in the linked Apache security note (not present in the provided text—users must consult the official advisory).
### Workarounds
- Since attackers use standard HTTP requests, traditional security filters may not easily detect the payload due to base64 encoding. No specific technical workarounds were detailed in this summary excerpt, but patching immediately is implied given the active exploitation.
## Detection
- **Indicators of Compromise:** Anomalous session creation/retrieval patterns involving suspicious data in HTTP requests/responses.
- **Detection methods and tools:** Attacks are reported to bypass traditional security filters. Custom monitoring for unusual `PUT` operations writing to session storage followed by specific `GET` requests targeting those sessions should be implemented until patched.
## References
- Vendor Advisories: Apache Security Note (March 10th disclosure).
- Relevant links:
- Base article: [hXXps://www.techrepublic.com/article/news-apache-tomcat-vulnerability/](hXXps://www.techrepublic.com/article/news-apache-tomcat-vulnerability/)
- PoC Example: [hXXps://github.com/iSee857/CVE-2025-24813-PoC/blob/main/Tomcat_CVE-2025-24813_RCE.py](hXXps://github.com/iSee857/CVE-2025-24813-PoC/blob/main/Tomcat_CVE-2025-24813_RCE.py)