InfoSecBulletin Cybersecurity for mankind
A critical vulnerability, CVE-2025-24813, has been found in Apache Tomcat, which could let attackers execute remote code, leak sensitive data, or corrupt information. The Apache Software Foundation has released an urgent advisory, urging affected users to update right away.
Apache Tomcat, a popular open-source web server and servlet container, has a vulnerability related to how it handles partial PUT requests. The issue arises from its original implementation, which used a temporary file based on the user-provided file name and path, replacing separators with “.”.. This seemingly small oversight can lead to a major security risk in certain conditions.
CVE-2025-24201
Apple fixes 0-day exploited in “extremely sophisticated attack”
Microsoft’s March 2025 updates fix 7 zero-day, 57 flaws
Ballista Botnet infects 6000 Unpatched TP-Link Routers
CVE-2025-24813
Flaw in Apache Tomcat Exposes Servers to RCE
CISA Adds 3 Ivanti Endpoint Manager Bugs to KEV
Ransomware Attacks Set Records in February: New Data Shows
Cyber attack at Japanese telecom leader NTT hits 18,000 companies
Cyber heist: Pune losses Rs 6007 crore in cyber scam
Nearly 1 million airport lost and found records leaked
Exploiting CVE-2024-4577, Attackers Target Japan with Cobalt Strike
The advisory outlines two primary exploitation scenarios:
Information Disclosure and Corruption:
If writes are enabled for the default servlet (disabled by default), partial PUT support is active (enabled by default), a target URL for sensitive uploads is a subdirectory of a public upload URL, and an attacker knows the sensitive file names being uploaded via partial PUT, they can “view security sensitive files and/or inject content into those files.”
Remote Code Execution (RCE):
If writes are enabled for the default servlet, partial PUT is active, the application uses Tomcat’s file-based session persistence with the default storage, and the application includes a library vulnerable to deserialization attacks, “a malicious user was able to perform remote code execution.”
These scenarios demonstrate the serious risks, including unauthorized access to sensitive data and total server compromise.
The CVE-2025-24813 vulnerability affects the following Apache Tomcat versions:
Apache Tomcat 11.0.0-M1 to 11.0.2
Apache Tomcat 10.1.0-M1 to 10.1.34
Apache Tomcat 9.0.0.M1 to 9.0.98
The Apache Software Foundation advises users of these versions to take one of the following actions:
Upgrade to Apache Tomcat 11.0.3 or later.
Upgrade to Apache Tomcat 10.1.35 or later.
Upgrade to Apache Tomcat 9.0.99 or later.
This vulnerability poses a serious threat due to risks of data breaches and remote code execution. The default activation of the partial PUT feature in affected versions increases the danger. Many production servers could be at risk if not promptly patched.
Server administrators must quickly upgrade to the patched versions of affected Apache Tomcat to protect against this vulnerability.
