The Cybersecurity and Infrastructure Security Agency (CISA) has included a severe Apache Tomcat vulnerability in its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation in real-world attacks.
Tracked as CVE-2025-24813, the vulnerability stems from a path equivalence flaw in the popular web server software, which could allow remote attackers to execute arbitrary code, access confidential data, or inject harmful content.
Overview of the Apache Tomcat Path Equivalence Flaw
CVE-2025-24813 is rated with a CVSS score of 9.8, signifying a critical risk to systems running outdated versions of Tomcat. The flaw is caused by improper handling of partial PUT requests, which enables unauthenticated attackers to execute arbitrary code by chaining together multiple attack techniques.
Security experts have indicated that this vulnerability isn’t universally exploitable but requires a precise configuration setup. When the right conditions are in place, however, the attack can be “extremely easy” to carry out, according to researchers at Wallarm.
Multiple versions of Apache Tomcat are impacted, including those from 11.0.0-M1 to 11.0.2, 10.1.0-M1 to 10.1.34, and 9.0.0-M1 to 9.0.98. Additionally, certain 8.5.x versions (specifically 8.5.0 to 8.5.98 and 8.5.100, excluding 8.5.99) are also vulnerable, although these were not initially highlighted in Apache’s advisory.
Vulnerability Summary
| Risk Factor | Details |
|---|---|
| Affected Products | Apache Tomcat versions 9.0.0-M1 to 9.0.98, 10.1.0-M1 to 10.1.34, and 11.0.0-M1 to 11.0.2 |
| Impact | Remote Code Execution (RCE), Information Disclosure, Malicious Content Injection, Unauthorized modification of uploaded file |
| Exploit Prerequisites | Default servlet write access, Partial PUT requests allowed, File-based session persistence, Presence of vulnerable deserialization library, Knowledge of internal file naming conventions |
| CVSS 3.1 Score | 9.8 (Critical) |
Exploitation Process
The exploit begins when attackers send a PUT request with a Base64-encoded serialized Java payload to the vulnerable server. This is followed by a GET request with a specifically crafted “JSESSIONID” cookie that refers to the malicious session. This triggers the server to deserialize the payload and execute the attacker’s code.
For successful exploitation, the following conditions must be met:
- The default servlet must have write permissions enabled (default is off).
- Partial PUT support must be active (enabled by default).
- The application must use Tomcat’s file-based session persistence.
- The application must include a deserialization-vulnerable library.
Remediation Actions
CISA has flagged CVE-2025-24813 as a “frequent attack vector for malicious cyber actors” that poses “significant risks” to federal agencies. As a result, all Federal Civilian Executive Branch (FCEB) agencies must remediate the vulnerability by April 22, 2025, in accordance with Binding Operational Directive (BOD) 22-01.
Although the directive applies only to federal entities, CISA strongly advises all organizations to address this vulnerability promptly to mitigate the risk of cyberattacks.
Apache has released security patches to resolve this issue. Organizations are urged to upgrade to Apache Tomcat versions 9.0.99, 10.1.35, or 11.0.3, depending on their environment.
Additional mitigation measures recommended by security experts include:
- Disabling unnecessary HTTP methods.
- Implementing strict access controls.
- Using Web Application Firewalls (WAFs).
- Monitoring for potential threat indicators.
For those unable to apply patches immediately, security teams should review server configurations to ensure that the default servlet does not have write permissions enabled, as this is crucial for exploitation.
