oss-security - CVE-2025-24813: Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <f5aaf921-b849-4978-9a8f-0b5ff044ac3e@apache.org>
Date: Mon, 10 Mar 2025 16:44:57 +0000
From: Mark Thomas <markt@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-24813: Apache Tomcat: Potential RCE and/or information
 disclosure and/or information corruption with partial PUT

Severity: important

Affected versions:

- Apache Tomcat 11.0.0-M1 through 11.0.2
- Apache Tomcat 10.1.0-M1 through 10.1.34
- Apache Tomcat 9.0.0.M1 through 9.0.98

Description:

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code 
Execution and/or Information disclosure and/or malicious content added 
to uploaded files via write enabled Default Servlet in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 
10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.

If all of the following were true, a malicious user was able to view 
   security sensitive files and/or inject content into those files:
- writes enabled for the default servlet (disabled by default)
- support for partial PUT (enabled by default)
- a target URL for security sensitive uploads that was a sub-directory 
of a target URL for public uploads
- attacker knowledge of the names of security sensitive files being uploaded
- the security sensitive files also being uploaded via partial PUT

If all of the following were true, a malicious user was able to 
perform remote code execution:
- writes enabled for the default servlet (disabled by default)
- support for partial PUT (enabled by default)
- application was using Tomcat's file based session persistence with the 
default storage location
- application included a library that may be leveraged in a 
deserialization attack

Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.98, 
which fixes the issue.

Credit:

COSCO Shipping Lines DIC (finder)
sw0rd1ight (https://github.com/sw0rd1ight) (finder)

References:

https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq
https://tomcat.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-24813

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.