CVE-2025-24813 : A Critical Apache Tomcat Path Equivalence Vulnerability

On March 10, 2025, a critical vulnerability in Apache Tomcat, identified as CVE-2025-24813, was publicly disclosed. This vulnerability, known as a path equivalence issue, affects how Apache Tomcat processes file paths internally. It has the potential to lead to remote code execution (RCE), severe information leakage, or malicious content injection, making it a significant concern for administrators and developers using this popular web server and Java servlet container.

Technical Details

Configuration Requirements

CVE-2025-24813 exploitation hinges on specific Tomcat configurations. The advisory outlines two universal prerequisites for all attack vectors:

Writes Enabled for the Default Servlet: By default, the readonly property of the DefaultServlet is set to true, preventing write operations via HTTP methods like PUT. To make a system vulnerable, this must be explicitly set to false in the web.xml configuration file, as shown below:

<servlet>
    <servlet-name>default</servlet-name>
    <servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>
    <init-param>
        <param-name>readonly</param-name>
        <param-value>false</param-value>
    </init-param>
</servlet>

Support for Partial PUT: This is enabled by default in Tomcat, handled by the doPut() method in the DefaultServlet. No additional configuration is needed to satisfy this condition.

For the most severe outcome—remote code execution—an additional non-default configuration is required:

File-Based Session Persistence: The application must use Tomcat’s PersistentManager with the FileStore class for session persistence, storing session data as individual files in the default location (typically /var/lib/tomcat10/work/Catalina/<hostname>/<app>/ on Debian). This can be enabled by adding the following to the context.xml file (e.g., /etc/tomcat10/context.xml):

<manager classname="org.apache.catalina.session.PersistentManager" maxidlebackup="1" saveonrestart="true" processexpiresfrequency="1">
<br>
<store classname="org.apache.catalina.session.FileStore">
<br>
</store>
</manager>

Remote Code Execution: How It Works
For RCE, attackers exploit the overlap between the temporary file location and the session storage directory. Tomcat’s FileStore periodically parses files with a .session extension in the work directory as serialized Java objects. If an attacker can place a malicious .session file there, it will be deserialized, potentially executing arbitrary code.

However, direct overwriting of session files via executePartialPut() is thwarted because the path always begins with a /, resulting in a filename prefixed with a dot (e.g., .examples.x1.session). Attempts to bypass this restriction—using absolute paths, backslashes, encoded slashes, or Unicode tricks—proved ineffective due to Tomcat’s request normalization and security checks.

The breakthrough comes from a simpler approach: manually placing a crafted .session file in the work directory (or uploading it via a vulnerable configuration) and letting Tomcat’s session persistence mechanism handle the rest. This method doesn’t rely on the “path equivalence” aspect of the vulnerability but exploits the direct control over filenames allowed by the partial PUT logic.

A proof-of-concept (PoC) tested by Unit42 team of PaloAlto is here.

Impacts

If exploited, CVE-2025-24813 can lead to unauthenticated remote code execution, allowing attackers to execute arbitrary code on the affected server. Additionally, it can result in severe information leakage or the injection of malicious content, potentially corrupting critical server configuration files. The impact of this vulnerability is significant, as it can compromise the security and integrity of the affected systems.

Affected Versions

Affected Apache Tomcat versions:

• Apache Tomcat 9.0.0.M1 to 9.0.98
• Apache Tomcat 10.1.0-M1 to 10.1.34
• Apache Tomcat 11.0.0-M1 to 11.0.2

This vulnerability arises from improper normalization of file paths containing internal dots, allowing attackers to access or modify sensitive files. If exploited, it could lead to severe security risks for web applications and servers.

Mitigation and Recommendations

To mitigate the Apache Tomcat Path Equivalence Vulnerability, users should upgrade to one of the following patched versions:

• 11.0.3 or later
• 10.1.35 or later
• 9.0.99 or later

For end-of-life (EoL) 8.5.x versions, users should migrate to a supported Apache Tomcat branch. If immediate upgrading is not feasible, implementing network-level controls to restrict access to the Tomcat server is recommended to reduce the risk of exploitation.

Malicious IP sources attempting to exploit this CVE find from Greynoise.

For updated details, follow the Apache Software Foundation’s Security Advisory.

CVE-2025-24813 is a nuanced vulnerability, blending path equivalence flaws with session persistence quirks to enable serious attacks. While its full exploitation requires specific, non-default configurations, the potential for RCE, information disclosure, or data tampering makes it a notable risk. Administrators should patch to Tomcat 10.1.35 or later, verify readonly=true, and avoid file-based persistence unless necessary.

Stay vigilant, and happy hardening!