Hackers Are Actively Exploiting Apache Tomcat Servers Exploiting CVE-2025-24813 – Patch Now
- С сайта: Vulnerability(cybersecuritynews.com)
- Вернуться к списку новостей
С сайта: Vulnerability(cybersecuritynews.com)
Threat actors actively exploit a critical vulnerability in Apache Tomcat, tracked as CVE-2025-24813, which could enable unauthorized remote code execution (RCE) on vulnerable servers.
The vulnerability, first disclosed on March 10, 2025, has already seen exploitation attempts beginning just 30 hours after the public release of proof-of-concept (PoC) code.
GreyNoise Intelligence hasidentifiedfour unique IP addresses that have been attempting to exploit this vulnerability since March 17, 2025, with exploitation attempts observed as early as March 11.
These attackers are leveraging a partial PUT method to inject malicious payloads, which could potentially lead to arbitrary code execution on affected systems.
“Exploitation is already underway, with attack attempts spanning multiple countries. Given Apache Tomcat’s widespread deployment, these early signs of activity suggest more exploitation is likely to follow,” security researchers warned.
Apache Tomcat Vulnerability – CVE-2025-24813
The root cause of CVE-2025-24813 lies in how Apache Tomcat handles file paths during partial PUT requests.
When a user uploads a file, Tomcat creates a temporary file using the provided filename and path, replacing path separators with dots.
This approach, originally intended as a security measure against path traversal, inadvertently opened a new vulnerability.
Exploitation involves two primary steps: first, an attacker sends a PUT request to upload a crafted Java session file, manipulating the file name and path to exploit the path equivalence vulnerability.
Second, the attacker triggers deserialization of the uploaded session file by sending a GET request referencing the malicious session ID, potentially leading to remote code execution.
The vulnerability affects multiple versions of Apache Tomcat:
The summary of the Vulnerability is given below:
Risk Factors Details Affected ProductsApache Tomcat 11.0.0-M1 to 11.0.2Apache Tomcat 10.1.0-M1 to 10.1.34Apache Tomcat 9.0.0-M1 to 9.0.98ImpactRemote Code Execution (RCE)Exploit Prerequisites-Default servlet must have write capability enabled-Partial PUT requests must be permitted
-Web application must use file-based session persistence
-Presence of a deserialization-vulnerable libraryCVSS 3.1 Score9.8 (Critical)
Exploit Attempts and Targeted Regions
Geographic analysis shows that the majority of exploit attempts have targeted systems in the United States, Japan, India, South Korea, and Mexico, with over 70% of sessions directed at U.S.-based systems.
Researchers observed initial exploit attempts from a Latvia-based IP on March 18, followed by separate attempts on March 19 from IPs traced to Italy, the United States, and China.
Unique IPs observed
For successful exploitation, several configurations must be true:
Mitigations
To protect against CVE-2025-24813, organizations running affected versions of Apache Tomcat should:
The NHS England National CSOC has assessed that “continued exploitation of this vulnerability is considered highly likely.”
Organizations are urged to immediately assess their Apache Tomcat deployments and apply patches to mitigate potential RCE risks.
While the vulnerability is serious, the specific configuration requirements make broad exploitation unlikely for properly maintained systems.
#Apache #Cyber_Security #Cyber_Security_News #Vulnerability #cyber_security #cyber_security_news
Оригинальная версия на сайте:
Hackers Are Actively Exploiting Apache Tomcat Servers Exploiting CVE-2025-24813 – Patch Now
Author: Guru BaranThreat actors actively exploit a critical vulnerability in Apache Tomcat, tracked as CVE-2025-24813, which could enable unauthorized remote code execution (RCE) on vulnerable servers.
The vulnerability, first disclosed on March 10, 2025, has already seen exploitation attempts beginning just 30 hours after the public release of proof-of-concept (PoC) code.
GreyNoise Intelligence hasidentifiedfour unique IP addresses that have been attempting to exploit this vulnerability since March 17, 2025, with exploitation attempts observed as early as March 11.
These attackers are leveraging a partial PUT method to inject malicious payloads, which could potentially lead to arbitrary code execution on affected systems.
“Exploitation is already underway, with attack attempts spanning multiple countries. Given Apache Tomcat’s widespread deployment, these early signs of activity suggest more exploitation is likely to follow,” security researchers warned.
Apache Tomcat Vulnerability – CVE-2025-24813
The root cause of CVE-2025-24813 lies in how Apache Tomcat handles file paths during partial PUT requests.
When a user uploads a file, Tomcat creates a temporary file using the provided filename and path, replacing path separators with dots.
This approach, originally intended as a security measure against path traversal, inadvertently opened a new vulnerability.
Exploitation involves two primary steps: first, an attacker sends a PUT request to upload a crafted Java session file, manipulating the file name and path to exploit the path equivalence vulnerability.
Second, the attacker triggers deserialization of the uploaded session file by sending a GET request referencing the malicious session ID, potentially leading to remote code execution.
The vulnerability affects multiple versions of Apache Tomcat:
- Apache Tomcat 11.0.0-M1 to 11.0.2
- Apache Tomcat 10.1.0-M1 to 10.1.34
- Apache Tomcat 9.0.0-M1 to 9.0.98
The summary of the Vulnerability is given below:
Risk Factors Details Affected ProductsApache Tomcat 11.0.0-M1 to 11.0.2Apache Tomcat 10.1.0-M1 to 10.1.34Apache Tomcat 9.0.0-M1 to 9.0.98ImpactRemote Code Execution (RCE)Exploit Prerequisites-Default servlet must have write capability enabled-Partial PUT requests must be permitted
-Web application must use file-based session persistence
-Presence of a deserialization-vulnerable libraryCVSS 3.1 Score9.8 (Critical)
Exploit Attempts and Targeted Regions
Geographic analysis shows that the majority of exploit attempts have targeted systems in the United States, Japan, India, South Korea, and Mexico, with over 70% of sessions directed at U.S.-based systems.
Researchers observed initial exploit attempts from a Latvia-based IP on March 18, followed by separate attempts on March 19 from IPs traced to Italy, the United States, and China.
Unique IPs observedFor successful exploitation, several configurations must be true:
- Writes enabled for the default servlet (disabled by default)
- Support for partial PUT (enabled by default)
- Application using Tomcat’s file-based session persistence with default storage location
- Application including a library that may be leveraged in a deserialization attack
Mitigations
To protect against CVE-2025-24813, organizations running affected versions of Apache Tomcat should:
- Apply the latest security patches immediately
- Monitor for unexpected PUT requests in web server logs
- Deploy Web Application Firewall (WAF) rules to block malicious payloads
- Track real-time exploitation activity and block malicious IPs
The NHS England National CSOC has assessed that “continued exploitation of this vulnerability is considered highly likely.”
Organizations are urged to immediately assess their Apache Tomcat deployments and apply patches to mitigate potential RCE risks.
While the vulnerability is serious, the specific configuration requirements make broad exploitation unlikely for properly maintained systems.
#Apache #Cyber_Security #Cyber_Security_News #Vulnerability #cyber_security #cyber_security_news
Оригинальная версия на сайте:
