{ "thread": { "from": "Mark Thomas ", "gravatar": "2ecfd40ef69301d18d9f6067ce5d23b9", "subject": "[SECURITY] CVE-2025-24813 Potential RCE and/or information disclosure and/or information corruption with partial PUT", "message-id": "<55efc37b-414b-47a9-8d9e-39b48152ab8c@apache.org>", "mid": "j5fkjv2k477os90nczf2v9l61fb0kkgq", "dbid": "5679bd4f76be96f95b77385d44139c70fa4b59fb3da107a497c775cd9bac75e5", "epoch": 1741624692, "list": "", "list_raw": "", "private": false, "in-reply-to": "", "body": "CVE-2025-24813 Potential RCE and/or information disclosure and/or \ninformation corruption with partial PUT\n\nSeverity: Important\n\nVendor: The Apache Software Foundation\n\nVersions Affected:\nApache Tomcat 11.0.0-M1 to 11.0.2\nApache Tomcat 10.1.0-M1 to 10.1.34\nApache Tomcat 9.0.0.M1 to 9.0.98\n\nDescription:\nThe original implementation of partial PUT used a temporary file based \non the user provided file name and path with the path separator replaced \nby \".\".\n\nIf all of the following were true, a malicious user was able to view \nsecurity sensitive files and/or inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory\n of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being\n uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to perform \nremote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat's file based session persistence with\n the default storage location\n- application included a library that may be leveraged in a\n deserialization attack\n\nMitigation:\nUsers of the affected versions should apply one of the following\nmitigations:\n- Upgrade to Apache Tomcat 11.0.3 or later\n- Upgrade to Apache Tomcat 10.1.35 or later\n- Upgrade to Apache Tomcat 9.0.99 or later\n\nCredit:\nInformation disclosure/corruption: COSCO Shipping Lines DIC\nRemote code execution: sw0rd1ight (https://github.com/sw0rd1ight)\n\nHistory:\n2025-03-10 Original advisory\n\nReferences:\n[1] https://tomcat.apache.org/security-11.html\n[2] https://tomcat.apache.org/security-10.html\n[3] https://tomcat.apache.org/security-9.html\n", "attachments": [], "id": "j5fkjv2k477os90nczf2v9l61fb0kkgq", "children": [ { "tid": "wzlqzhzdwj2z8x6dbwnyxt4n8j94g17z", "mid": "wzlqzhzdwj2z8x6dbwnyxt4n8j94g17z", "message-id": "<165F17E5-24F7-44CD-BF8D-4FD670894111@ads.northwestern.edu>", "subject": "Re: [SECURITY] CVE-2025-24813 Potential RCE and/or information disclosure and/or information corruption with partial PUT", "from": "Darryl Baker ", "id": "wzlqzhzdwj2z8x6dbwnyxt4n8j94g17z", "epoch": 1741788098, "children": [ { "tid": "kvnt17th8swrskf5qpym9xyqc87xkpr9", "mid": "kvnt17th8swrskf5qpym9xyqc87xkpr9", "message-id": "<2a676ffb-2c8f-4bb5-844c-5d56d62d957c@apache.org>", "subject": "Re: [SECURITY] CVE-2025-24813 Potential RCE and/or information disclosure and/or information corruption with partial PUT", "from": "Mark Thomas ", "id": "kvnt17th8swrskf5qpym9xyqc87xkpr9", "epoch": 1741789144, "children": [ { "tid": "ft5xqmdd448nd9b2cxlyl4yh33lt30sx", "mid": "ft5xqmdd448nd9b2cxlyl4yh33lt30sx", "message-id": "<9C3C090F-C90A-4AC0-A2F6-96DEFABCEACC@ads.northwestern.edu>", "subject": "Re: [SECURITY] CVE-2025-24813 Potential RCE and/or information disclosure and/or information corruption with partial PUT", "from": "Darryl Baker ", "id": "ft5xqmdd448nd9b2cxlyl4yh33lt30sx", "epoch": 1741800239, "children": [ { "tid": "kf7hs7gv7hgpnww1ocmvbfo72qwgb4bm", "mid": "kf7hs7gv7hgpnww1ocmvbfo72qwgb4bm", "message-id": "<7644f95b-7096-4a5c-bfa9-a970b5f2983e@christopherschultz.net>", "subject": "Re: [SECURITY] CVE-2025-24813 Potential RCE and/or information disclosure and/or information corruption with partial PUT", "from": "Christopher Schultz ", "id": "kf7hs7gv7hgpnww1ocmvbfo72qwgb4bm", "epoch": 1741803820, "children": [], "irt": "<9C3C090F-C90A-4AC0-A2F6-96DEFABCEACC@ads.northwestern.edu>", "list_raw": "" } ], "irt": "<2a676ffb-2c8f-4bb5-844c-5d56d62d957c@apache.org>", "list_raw": "" } ], "irt": "<165F17E5-24F7-44CD-BF8D-4FD670894111@ads.northwestern.edu>", "list_raw": "" } ], "irt": "<55efc37b-414b-47a9-8d9e-39b48152ab8c@apache.org>", "list_raw": "" } ] }, "emails": [ { "from": "Mark Thomas ", "gravatar": "2ecfd40ef69301d18d9f6067ce5d23b9", "subject": "[SECURITY] CVE-2025-24813 Potential RCE and/or information disclosure and/or information corruption with partial PUT", "message-id": "<55efc37b-414b-47a9-8d9e-39b48152ab8c@apache.org>", "mid": "j5fkjv2k477os90nczf2v9l61fb0kkgq", "dbid": "5679bd4f76be96f95b77385d44139c70fa4b59fb3da107a497c775cd9bac75e5", "epoch": 1741624692, "list": "", "list_raw": "", "private": false, "in-reply-to": "", "body": "CVE-2025-24813 Potential RCE and/or information disclosure and/or \ninformation corruption with partial PUT\n\nSeverity: Important\n\nVendor: The Apache Software Foundation\n\nVersions Affected:\nApache Tomcat 11.0.0-M1 to 11.0.2\nApache Tomcat 10.1.0-M1 to 10.1.34\nApache Tomcat 9.0.0.M1 to 9.0.98\n\nDescription:\nThe original implementation of partial PUT used a temporary file based \non the user provided file name and path with the path separator replaced \nby \".\".\n\nIf all of the following were true, a malicious user was able to view \nsecurity sensitive files and/or inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory\n of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being\n uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to perform \nremote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat's file based session persistence with\n the default storage location\n- application included a library that may be leveraged in a\n deserialization attack\n\nMitigation:\nUsers of the affected versions should apply one of the following\nmitigations:\n- Upgrade to Apache Tomcat 11.0.3 or later\n- Upgrade to Apache Tomcat 10.1.35 or later\n- Upgrade to Apache Tomcat 9.0.99 or later\n\nCredit:\nInformation disclosure/corruption: COSCO Shipping Lines DIC\nRemote code execution: sw0rd1ight (https://github.com/sw0rd1ight)\n\nHistory:\n2025-03-10 Original advisory\n\nReferences:\n[1] https://tomcat.apache.org/security-11.html\n[2] https://tomcat.apache.org/security-10.html\n[3] https://tomcat.apache.org/security-9.html\n", "attachments": [], "id": "j5fkjv2k477os90nczf2v9l61fb0kkgq", "children": [ { "tid": "wzlqzhzdwj2z8x6dbwnyxt4n8j94g17z", "mid": "wzlqzhzdwj2z8x6dbwnyxt4n8j94g17z", "message-id": "<165F17E5-24F7-44CD-BF8D-4FD670894111@ads.northwestern.edu>", "subject": "Re: [SECURITY] CVE-2025-24813 Potential RCE and/or information disclosure and/or information corruption with partial PUT", "from": "Darryl Baker ", "id": "wzlqzhzdwj2z8x6dbwnyxt4n8j94g17z", "epoch": 1741788098, "children": [ { "tid": "kvnt17th8swrskf5qpym9xyqc87xkpr9", "mid": "kvnt17th8swrskf5qpym9xyqc87xkpr9", "message-id": "<2a676ffb-2c8f-4bb5-844c-5d56d62d957c@apache.org>", "subject": "Re: [SECURITY] CVE-2025-24813 Potential RCE and/or information disclosure and/or information corruption with partial PUT", "from": "Mark Thomas ", "id": "kvnt17th8swrskf5qpym9xyqc87xkpr9", "epoch": 1741789144, "children": [ { "tid": "ft5xqmdd448nd9b2cxlyl4yh33lt30sx", "mid": "ft5xqmdd448nd9b2cxlyl4yh33lt30sx", "message-id": "<9C3C090F-C90A-4AC0-A2F6-96DEFABCEACC@ads.northwestern.edu>", "subject": "Re: [SECURITY] CVE-2025-24813 Potential RCE and/or information disclosure and/or information corruption with partial PUT", "from": "Darryl Baker ", "id": "ft5xqmdd448nd9b2cxlyl4yh33lt30sx", "epoch": 1741800239, "children": [ { "tid": "kf7hs7gv7hgpnww1ocmvbfo72qwgb4bm", "mid": "kf7hs7gv7hgpnww1ocmvbfo72qwgb4bm", "message-id": "<7644f95b-7096-4a5c-bfa9-a970b5f2983e@christopherschultz.net>", "subject": "Re: [SECURITY] CVE-2025-24813 Potential RCE and/or information disclosure and/or information corruption with partial PUT", "from": "Christopher Schultz ", "id": "kf7hs7gv7hgpnww1ocmvbfo72qwgb4bm", "epoch": 1741803820, "children": [], "irt": "<9C3C090F-C90A-4AC0-A2F6-96DEFABCEACC@ads.northwestern.edu>", "list_raw": "" } ], "irt": "<2a676ffb-2c8f-4bb5-844c-5d56d62d957c@apache.org>", "list_raw": "" } ], "irt": "<165F17E5-24F7-44CD-BF8D-4FD670894111@ads.northwestern.edu>", "list_raw": "" } ], "irt": "<55efc37b-414b-47a9-8d9e-39b48152ab8c@apache.org>", "list_raw": "" } ] } ] }