Known widely as the Apache Tomcat exploit, this flaw allows unauthenticated remote code execution (RCE) on vulnerable systems under specific conditions. A critical security vulnerability in Apache Tomcat, tracked as CVE-2025-24813, is currently being actively exploited in the wild.
This guide will walk you through what the Apache Tomcat exploit is, how it works, and most importantly, how to secure your server to prevent it from being compromised.
Organizations running affected versions of Tomcat are strongly urged to apply security updates immediately to mitigate this threat.
What Is CVE-2025-24813?
Disclosed on March 10, 2025, CVE-2025-24813 stems from a path equivalence issue in Apache Tomcat’s handling of file names during partial PUT requests. The vulnerability arises when Tomcat replaces path separators with dots in uploaded filenames—originally a mitigation against path traversal. Unfortunately, this approach introduces a new avenue for exploitation.
🚨 Affected Versions:
- Tomcat 9.0.0.M1 – 9.0.98
- Tomcat 10.1.0-M1 – 10.1.34
- Tomcat 11.0.0-M1 – 11.0.2
🛠️ Mitigation Guide
✅ Step 1: Upgrade Apache Tomcat
How to upgrade:
- 🔄 Backup existing Tomcat setup.
- 📥 Download the updated version:
- 📂 Replace or install the new version.
- 🛠️ Restore your configuration files.
- 🚀 Restart the Tomcat server.
- ✅ Test applications for stability.
🔍 Step 2: Monitor Server Logs for Suspicious PUT Requests
How to monitor:
- Find logs in:
logs/access_log.*orcatalina.out - Run: bashCopy
grep '"PUT ' logs/catalina.out - Look for unknown IPs or large payloads.
- 💡 Use tools like ELK, Splunk, or Graylog for real-time analysis.
🧱 Step 3: Deploy Web Application Firewall (WAF) Rules
Recommended actions:
- Use WAFs like ModSecurity, AWS WAF, or Cloudflare.
- Create rules to:
- ❌ Block partial PUT requests
- ❌ Reject suspicious upload paths or filenames
- Keep WAF rules updated.
- Review WAF logs regularly.
⛔ Step 4: Blacklist Suspicious IPs
Steps:
- Identify attacking IPs from logs.
- Use firewall to block: bashCopy
sudo iptables -A INPUT -s <ip_address> -j DROP - Automate using fail2ban or similar tools.
- Stay informed with threat intelligence feeds.
📊 Targeted Regions (So Far)
| Country | % of Attacks |
|---|---|
| 🇺🇸 United States | 70%+ |
| 🇯🇵 Japan | Medium |
| 🇮🇳 India | Medium |
| 🇰🇷 South Korea | Medium |
| 🇲🇽 Mexico | Low |
📌 Final Reminder:
NHS England’s National CSOC warns that continued exploitation is highly likely.
The NHS England National CSOC has warned that ongoing exploitation of the Apache Tomcat exploit (CVE-2025-24813) is “highly likely.” While widespread attacks require specific configuration setups, any unpatched systems remain at serious risk.
🔧 Ensure your systems are protected—apply the necessary patches immediately and thoroughly review your Tomcat configurations to minimize exposure to this exploit.
Stay safe out there. 🛡️🕵️♂️