Title: Critical Alert: Apache Tomcat Servers Targeted by New Exploit – CVE-2025-24813

A newly identified vulnerability in Apache Tomcat, CVE-2025-24813, is currently being exploited, allowing attackers to perform remote code execution (RCE) on impacted servers. This issue underscores the urgent need for heightened cybersecurity measures.

This critical security flaw impacts Apache Tomcat versions from 9.0.0-M1 to 9.0.98, 10.1.0-M1 to 10.1.34, and 11.0.0-M1 to 11.0.2, with patched versions now available for enhanced protection.

The vulnerability specifically arises from improper handling of partial PUT requests and path equivalence issues, enabling attackers to circumvent security protocols and execute arbitrary code without necessary authentication when certain conditions are met.

Exploitation Techniques and Potential Risks

Attackers exploit this vulnerability through a two-step approach:

1. A PUT request with a malicious Java payload is sent to a writable directory, setting the stage for RCE upon its deserialization.
2. Following this, a GET request with a specially crafted “JSESSIONID” cookie prompts the server to deserialize the payload, triggering arbitrary code execution.

Despite the sophisticated nature of this attack, successful exploitation is generally challenging due to the specific prerequisites needed, such as write permissions for the default servlet and partial PUT request support. High-profile attempts have primarily been observed in the United States, Japan, India, South Korea, and Mexico. The proliferation of related proof-of-concept (PoC) exploits has simplified these attacks, drawing attention from various attacker profiles.

Recommended Mitigation Strategies

To defend against these vulnerabilities, it is critical to upgrade affected systems to the latest Apache Tomcat versions (9.0.99, 10.1.35, or 11.0.3). For organizations where immediate upgrading is not viable, here are several protective steps:

• Implement network-level restrictions to limit access to vulnerable Tomcat instances.
• Disable unnecessary HTTP methods and enhance access control measures to fortify security.
• Deploy continuous monitoring strategies and employ web application firewalls (WAFs) to identify and mitigate potential threats.

Staying informed and prepared is crucial for maintaining the integrity and security of your systems. For further technical details and continuous updates on this vulnerability, consider referencing the detailed analysis provided by Insikt Group and exploring various cybersecurity resources.

Find More Information Here