Apache Tomcat 9.0.0.M1 < 9.0.99

CVE-2025-24813 is a path-equivalence flaw in Apache Tomcat's partial PUT handling that can lead to remote code execution via Java deserialization or, at a lower bar, information disclosure and file corruption. It affects Tomcat 9.0.0.M1 through 9.0.98 (fixed in 9.0.99), 10.1.0-M1 through 10.1.34 (fixed in 10.1.35), and 11.0.0-M1 through 11.0.2 (fixed in 11.0.3). The attack sends a crafted partial PUT to write a malicious serialized payload, then triggers deserialization via a GET with a crafted JSESSIONID cookie.

The vendor CVSS of 9.8 CRITICAL overstates real-world risk for the vast majority of deployments. The RCE chain demands three simultaneously non-default conditions: (1) default servlet write capability explicitly enabled (off by default), (2) file-based session persistence active with default storage path (off by default), and (3) a deserialization-gadget library on the classpath. Rapid7 analyzed GitHub and found roughly ~200 open-source projects using write-enabled default servlet configs — most with fewer than 30 stars. Rapid7 was unable to confirm any successful exploitation in real-world production environments. The 9.8 score treats this as a trivial unauthenticated RCE, but in practice the prerequisite chain breaks on the first condition for the overwhelming majority of Tomcat installations.

Why this verdict

• Non-default prerequisite chain: RCE requires three simultaneously non-default conditions — readonly=false on default servlet, file-based session persistence, and a gadget library. Each is independently uncommon; their intersection is extremely rare in production. This is a compounding downward pressure from the 9.8 baseline.
• Rapid7 production validation failure: Rapid7 explicitly states they were *unable to confirm any successful exploitation in real-world production environments*. GreyNoise observed only naive PoC probing from 4–7 IPs. This suggests the CVSS 9.8 models a theoretical worst case, not operational reality.
• Role multiplier: Tomcat is an application server, not a canonically high-value-role component (it is not a domain controller, hypervisor, identity provider, PAM, or backup system). In typical deployments (web application tier), compromise yields application-level access — not domain/fleet/supply-chain scale impact. In rare cases where Tomcat fronts identity services (e.g., Keycloak on Tomcat), the blast radius could escalate to identity-tier, but even then the non-default prerequisite chain must still be satisfied. The floor for a non-canonical high-value component with active KEV listing is HIGH.
• KEV listing anchors the floor: Despite the friction, CISA has listed this in KEV, indicating at least some evidence of exploitation. Combined with the 99.97th percentile EPSS and massive exposure surface (~378K+ instances), we cannot drop below HIGH.
• CVSS AC:L is misleading: The base vector scores Attack Complexity as Low, but CVSS does not model application-layer configuration prerequisites. The real attack complexity is substantially higher than the vector indicates.

Why not higher?

CRITICAL would be appropriate if this were a trivially exploitable unauthenticated RCE with default-on prerequisites. It is not. The three non-default configuration requirements — each independently uncommon in production — compound to make the actually-exploitable population a tiny fraction of the installed base. Rapid7's inability to confirm any real-world production compromise, despite weeks of investigation and widespread scanning, is strong evidence that the theoretical 9.8 does not materialize in practice. Tomcat is also not a canonical high-value-role component where compromise inherently yields fleet-scale impact.

Why not lower?

MEDIUM or LOW would underweight the KEV listing, the 99.97th-percentile EPSS score, and the sheer scale of Tomcat's installed base. Even if only 1–2% of Tomcat instances run the vulnerable configuration, that still represents thousands of potentially exploitable servers globally. The vulnerability is unauthenticated and requires no user interaction — if the prerequisites happen to be met, exploitation is trivial. The KEV listing establishes a hard floor that prevents further downgrade.

1. Verify and enforce readonly=true on the default servlet — Check conf/web.xml for the DefaultServlet's readonly init-param. If it is false, set it to true and restart Tomcat. This single change kills the entire attack chain regardless of other conditions. Deploy within the noisgate mitigation SLA of 30 days for HIGH, but given KEV status, treat as immediate.
2. Disable file-based session persistence — Ensure conf/context.xml does not contain a <Manager pathname="..."/> entry pointing to file-based session storage. Use in-memory sessions or external session stores (Redis, JDBC, Memcached). This eliminates the deserialization trigger path.
3. Deploy WAF rules to block partial PUT to session paths — Enable Akamai Rule 3000957 in block mode, or deploy equivalent ModSecurity/NGINX rules matching PUT requests with .session file extensions or Java serialization headers (0xACED0005). This provides defense-in-depth while patching proceeds.
4. Audit and remove unnecessary deserialization gadget libraries — Review application classpath for commons-collections (< 3.2.2 / < 4.1), commons-beanutils, and other known gadget libraries. Upgrade or remove them. This eliminates the deserialization payload execution even if a file is written.
5. Run Tomcat as a dedicated low-privilege service account — Ensure the Tomcat process runs as a non-root, non-admin service account with minimal filesystem permissions. This limits post-exploitation blast radius if RCE is achieved. Standard CIS Benchmark hardening.

Run this script on each Tomcat host as a user with read access to the Tomcat configuration directory. Invoke with: sudo bash check_cve_2025_24813.sh /opt/tomcat (pass the Tomcat installation root as the first argument). No network access required.

#!/usr/bin/env bash
# check_cve_2025_24813.sh — CVE-2025-24813 exposure check
# Usage: bash check_cve_2025_24813.sh <TOMCAT_HOME>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

CATALINA_HOME="${1:-}"
if [[ -z "$CATALINA_HOME" ]]; then
  echo "UNKNOWN — usage: $0 <TOMCAT_HOME>"
  exit 2
fi

# --- 1. Check Tomcat version ---
VERSION_FILE="$CATALINA_HOME/lib/catalina.jar"
if [[ ! -f "$VERSION_FILE" ]]; then
  echo "UNKNOWN — cannot find catalina.jar at $CATALINA_HOME/lib/"
  exit 2
fi

TOMCAT_VERSION=$(unzip -p "$VERSION_FILE" org/apache/catalina/util/ServerInfo.properties 2>/dev/null | grep '^server.number=' | cut -d= -f2 | tr -d '[:space:]')
if [[ -z "$TOMCAT_VERSION" ]]; then
  echo "UNKNOWN — could not extract Tomcat version from catalina.jar"
  exit 2
fi

echo "Detected Tomcat version: $TOMCAT_VERSION"

# --- 2. Version comparison (9.x branch) ---
# Affected: 9.0.0 through 9.0.98; Fixed: 9.0.99+
# Also check 10.1.x (affected through 10.1.34) and 11.0.x (affected through 11.0.2)
MAJOR=$(echo "$TOMCAT_VERSION" | cut -d. -f1)
MINOR=$(echo "$TOMCAT_VERSION" | cut -d. -f2)
PATCH=$(echo "$TOMCAT_VERSION" | cut -d. -f3)

VULN_VERSION=false
if [[ "$MAJOR" -eq 9 && "$MINOR" -eq 0 && "$PATCH" -lt 99 ]]; then
  VULN_VERSION=true
elif [[ "$MAJOR" -eq 10 && "$MINOR" -eq 1 && "$PATCH" -lt 35 ]]; then
  VULN_VERSION=true
elif [[ "$MAJOR" -eq 11 && "$MINOR" -eq 0 && "$PATCH" -lt 3 ]]; then
  VULN_VERSION=true
fi

if [[ "$VULN_VERSION" = false ]]; then
  echo "PATCHED — Tomcat $TOMCAT_VERSION is not in the affected range for CVE-2025-24813"
  exit 0
fi

echo "[!] Version $TOMCAT_VERSION is in the affected range"

# --- 3. Check if default servlet has writes enabled ---
WEB_XML="$CATALINA_HOME/conf/web.xml"
WRITES_ENABLED=false
if [[ -f "$WEB_XML" ]]; then
  # Look for readonly param set to false within DefaultServlet definition
  if grep -A 30 'org.apache.catalina.servlets.DefaultServlet' "$WEB_XML" | grep -qi 'readonly.*false'; then
    WRITES_ENABLED=true
    echo "[!] Default servlet writes ENABLED (readonly=false) — prerequisite MET"
  else
    echo "[+] Default servlet writes disabled (readonly=true or default) — primary prerequisite NOT met"
  fi
else
  echo "[?] Cannot find web.xml at $WEB_XML"
fi

# --- 4. Check for file-based session persistence ---
CONTEXT_XML="$CATALINA_HOME/conf/context.xml"
SESSION_PERSIST=false
if [[ -f "$CONTEXT_XML" ]]; then
  if grep -qi 'FileStore\|PersistentManager' "$CONTEXT_XML"; then
    SESSION_PERSIST=true
    echo "[!] File-based session persistence detected — prerequisite MET"
  else
    echo "[+] No file-based session persistence found — RCE prerequisite NOT met"
  fi
fi

# --- 5. Final verdict ---
if [[ "$WRITES_ENABLED" = true && "$SESSION_PERSIST" = true ]]; then
  echo ""
  echo "VULNERABLE — Tomcat $TOMCAT_VERSION with writes enabled AND file-based sessions. RCE chain is feasible."
  exit 1
elif [[ "$WRITES_ENABLED" = true ]]; then
  echo ""
  echo "VULNERABLE — Tomcat $TOMCAT_VERSION with writes enabled. Information disclosure / file corruption possible; RCE requires additional session persistence config."
  exit 1
else
  echo ""
  echo "VULNERABLE (version only) — Tomcat $TOMCAT_VERSION is in the affected range but critical prerequisites (readonly=false) are NOT met. Exploitation is not feasible in current configuration. Patch recommended."
  exit 1
fi

Sources

1. Tenable Plugin 232528
2. Rapid7 — CVE-2025-24813: What You Need to Know
3. GreyNoise — Active Exploitation of CVE-2025-24813
4. Akamai — Detecting and Mitigating CVE-2025-24813
5. Apache Tomcat 9 Security Advisories
6. CISA KEV — CVE-2025-24813
7. FIRST EPSS API — CVE-2025-24813
8. The Hacker News — Exploitation Within 30 Hours