InfoSecBulletin Cybersecurity for mankind
A critical vulnerability, CVE-2025-24813, has been found in Apache Tomcat, which could let attackers execute remote code, leak sensitive data, or corrupt information. The Apache Software Foundation has released an urgent advisory, urging affected users to update right away.
Apache Tomcat, a popular open-source web server and servlet container, has a vulnerability related to how it handles partial PUT requests. The issue arises from its original implementation, which used a temporary file based on the user-provided file name and path, replacing separators with “.”.. This seemingly small oversight can lead to a major security risk in certain conditions.
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
The advisory outlines two primary exploitation scenarios:
Information Disclosure and Corruption:
If writes are enabled for the default servlet (disabled by default), partial PUT support is active (enabled by default), a target URL for sensitive uploads is a subdirectory of a public upload URL, and an attacker knows the sensitive file names being uploaded via partial PUT, they can “view security sensitive files and/or inject content into those files.”
Remote Code Execution (RCE):
If writes are enabled for the default servlet, partial PUT is active, the application uses Tomcat’s file-based session persistence with the default storage, and the application includes a library vulnerable to deserialization attacks, “a malicious user was able to perform remote code execution.”
These scenarios demonstrate the serious risks, including unauthorized access to sensitive data and total server compromise.
The CVE-2025-24813 vulnerability affects the following Apache Tomcat versions:
Apache Tomcat 11.0.0-M1 to 11.0.2
Apache Tomcat 10.1.0-M1 to 10.1.34
Apache Tomcat 9.0.0.M1 to 9.0.98
The Apache Software Foundation advises users of these versions to take one of the following actions:
Upgrade to Apache Tomcat 11.0.3 or later.
Upgrade to Apache Tomcat 10.1.35 or later.
Upgrade to Apache Tomcat 9.0.99 or later.
This vulnerability poses a serious threat due to risks of data breaches and remote code execution. The default activation of the partial PUT feature in affected versions increases the danger. Many production servers could be at risk if not promptly patched.
Server administrators must quickly upgrade to the patched versions of affected Apache Tomcat to protect against this vulnerability.
