Apache Tomcat Partial PUT Path Equivalence RCE and File Disclosure

This repository is a small standalone Python proof-of-concept exploit for CVE-2025-24813 targeting Apache Tomcat. The repo contains four files: a README with vulnerability description and usage, one Python exploit script (cve-2025-24813.py), a minimal requirements.txt listing requests, and a .gitignore. The exploit is not part of a larger framework. The main exploit flow in cve-2025-24813.py is straightforward and operational: it first checks whether the target accepts HTTP PUT by sending a PUT request to /__cve_test__. If writable, it generates a random uppercase session ID, invokes a local Java ysoserial.jar process to build a serialized Java gadget payload for an attacker-supplied command, then uploads that payload to /uploads/../sessions/<SID>.session using path traversal. Finally, it sends a GET request to the target base URL with the JSESSIONID cookie set to the crafted SID, attempting to make Tomcat's PersistentManager/FileStore load and deserialize the malicious session file. The script explicitly notes that execution is blind and the operator must verify side effects separately. Capabilities: unauthenticated remote exploitation over HTTP(S), writable PUT probing, path traversal-based file placement into Tomcat session storage, deserialization trigger via session cookie, and arbitrary command execution through a ysoserial-generated gadget chain. The payload is customizable through the --command and --gadget arguments, but relies on an external local ysoserial.jar and Java runtime. Because it delivers a real command-execution payload but is still a simple standalone PoC rather than a reusable framework module, the maturity is best classified as OPERATIONAL.

This repository is a small, single-purpose exploit PoC for CVE-2025-24813 affecting Apache Tomcat under specific non-default configurations. It contains one Python exploit script and one README. The Python script is the main entry point and uses the requests library to perform a two-stage attack: first, it base64-decodes a hardcoded serialized Java gadget chain into a temporary local file (decoded_chain.bin), then uploads that file to the target as /payload.session using an HTTP PUT request with a Content-Range header to abuse Tomcat partial PUT handling. Second, it sends an HTTP HEAD request to the target root with the cookie JSESSIONID=.payload, attempting to make Tomcat load and deserialize the uploaded session file. The script treats an HTTP 500 response as likely exploitation success. The exploit’s core capability is unauthenticated remote code execution via Java deserialization in Tomcat session persistence. The payload is operational rather than just demonstrative because it includes a hardcoded serialized object chain and trigger logic, though payload customization is manual. Comments indicate the payload can be regenerated with ysoserial, and the embedded serialized blob appears to contain a command execution gadget chain invoking bash. The README explains the vulnerability prerequisites clearly: writable default servlet (readonly=false), partial PUT enabled, and file-based session persistence via PersistentManager/FileStore, plus a suitable gadget chain on the classpath. Overall, this is a straightforward network/web exploit PoC rather than a scanner or detection script.

Repository contains a single Python exploit script (exploit.py) and a README describing exploitation of CVE-2025-24813 against Apache Tomcat. Core purpose: achieve remote code execution by (1) obtaining or guessing a JSESSIONID, (2) verifying that the target accepts HTTP PUT with Content-Range, (3) generating a malicious payload (either via ysoserial gadget chain or a locally compiled Java class packaged into a JAR), (4) uploading the payload via PUT to a traversed path intended to land in Tomcat’s session storage ("/uploads/../sessions/{sid}.session"), and (5) triggering processing by issuing a GET request with a JSESSIONID cookie and interpreting an HTTP 500 response as success. Structure/capabilities by function: - get_sid(): GETs {target}/index.jsp and extracts JSESSIONID from cookies or from page content; otherwise uses hardcoded fallback "absholi7ly". - verify_put(): PUTs to {target}/check.txt with Content-Range headers to test write capability. - ysoserial_payload(): runs local Java ysoserial to produce a serialized payload executing "cmd.exe /c <cmd>" (Windows-oriented). - java_payload(): writes/compiles Java code that executes the provided command in a static initializer and packages it; cleans up temporary files. - send_payload(): PUTs the payload to /uploads/../sessions/{sid}.session; treats HTTP 409 as an expected upload result and then triggers with a GET and Cookie header. Notable observations: - The trigger GET request is sent to the base URL (not a specific endpoint) and uses a hardcoded cookie value ("absholi7ly") rather than the extracted sid, which may reduce reliability. - Success condition is inferred from HTTP 500, which is a heuristic rather than direct command output retrieval. - Payload generation defaults to Windows command execution (cmd.exe /c) in ysoserial mode; java mode executes the command string as provided.

This repository provides a comprehensive toolset for detecting and exploiting CVE-2025-24813, a path equivalence vulnerability in Apache Tomcat that can lead to remote code execution (RCE). The main components are: - 'tomcat-scanner.py': A Python3 script that performs multi-threaded scanning of Tomcat servers for the vulnerability. It uses a wordlist of potential paths (provided in 'wordlist.txt') to probe endpoints for path equivalence issues. The tool supports both detection and exploitation modes. In exploit mode, it attempts to execute arbitrary shell commands on the target server to confirm RCE. - 'check-tomcat-readonly.sh': A Bash script that checks the local system for vulnerable Tomcat configurations by searching for 'readonly=false' in web.xml files, which is a prerequisite for the vulnerability. - 'wordlist.txt': A large, curated list of paths and filenames relevant to Tomcat, Bonita, GoAnywhere, Artifactory, and other related products, including specific payloads and traversal patterns for CVE-2025-24813. - 'requirements.txt': Lists Python dependencies (requests, urllib3). - 'README.md': Detailed documentation on usage, features, and the nature of the vulnerability. The exploit is operational: it can both detect and actively exploit the vulnerability, providing confirmation of RCE if successful. The attack vector is network-based, targeting HTTP endpoints on Tomcat servers. The tool is highly configurable, supporting custom wordlists, multi-target scanning, and custom shell commands for exploitation. No hardcoded C2 or external IPs are present; all endpoints are user-supplied or derived from the wordlist. The repository is not part of a framework and is a standalone operational exploit and detection tool for CVE-2025-24813.

This repository provides a working exploit for CVE-2025-24813, targeting Apache Tomcat v9.0.90 on Windows Server 2019 with Java 25.0.1 and the vulnerable commons-collections-3.2.1.jar. The exploit leverages Java deserialization via a malicious session file, generated using ysoserial's CommonsCollections6 gadget. The Python script (exploit.py) automates payload generation, file upload via HTTP PUT, and exploitation by triggering deserialization with a crafted JSESSIONID cookie. The README provides detailed setup instructions for both the vulnerable environment and the attacker's machine, including all necessary dependencies and configuration changes. The exploit enables remote code execution on the target server, demonstrated by launching calc.exe. The repository is well-structured, with a single exploit script and comprehensive documentation, and is operational with a customizable payload.

This repository provides a proof-of-concept exploit for CVE-2025-24813, a remote code execution vulnerability in Apache Tomcat. The exploit consists of a single Python script ('cve-2025-24813-exploit.py') and a README.md with usage instructions and example output. The exploit works by uploading a maliciously crafted session file to the Tomcat server's session directory using an HTTP PUT request (leveraging Partial PUT functionality). It then triggers deserialization of this file by sending a GET request to the server with a JSESSIONID cookie matching the uploaded session file. If the server is vulnerable and properly configured, this results in arbitrary command execution on the server. The exploit is a POC and requires the target to have Partial PUT enabled, a vulnerable Commons Collections library, and session persistence. The code is straightforward, with clear entry points and no framework dependencies. The main network endpoints are the target Tomcat server's HTTP interface and the session file upload path.

This repository is a Proof-of-Concept (PoC) environment for demonstrating CVE-2025-24813, a vulnerability in Apache Tomcat (9.0.30) related to unsafe file writes via HTTP PUT and session deserialization. The repository contains a Dockerfile to build a vulnerable Tomcat instance, a context.xml to configure session persistence to disk, an upload.jsp endpoint that allows arbitrary file uploads to /tmp/app-data, and a web.xml that configures the DefaultServlet with readonly=false. The README provides detailed instructions for building the environment, uploading benign and malicious files, and using ysoserial to generate a Java serialized payload that, when deserialized by Tomcat as a session, can execute arbitrary commands (demonstrated with 'touch /tmp/RCE'). The main attack vector is network-based, leveraging HTTP requests to upload and trigger the exploit. Key endpoints include /upload.jsp for file upload and /index.jsp (with a crafted JSESSIONID cookie) to trigger deserialization. The PoC does not itself weaponize the exploit but demonstrates the full attack chain for RCE via session file injection and deserialization.

This repository demonstrates a proof-of-concept Java deserialization exploit for a Tomcat 10 (Jakarta) servlet environment. The main files are: - ExploitServlet.java: A servlet that accepts POST requests and deserializes objects from the request body. - SafeGadget.java: A serializable class whose deserialization triggers a file write to /tmp/pwn.txt. - SafeGadgetSerializer.java: A utility to generate a serialized payload (payload.ser) containing a SafeGadget object. - WEB-INF/web.xml: Configures the servlet to respond at /vuln-app/vulnerable_endpoint. - index.jsp: Provides a simple web page with instructions. The exploit works by sending a serialized SafeGadget object to the vulnerable endpoint, causing the server to write 'Pwned!' to /tmp/pwn.txt. This demonstrates the risk of insecure Java deserialization in servlet-based applications. No external network endpoints or domains are involved; the attack is local to the application server.

This repository contains a single Python exploit script (CVE_2025_24813.py) targeting Apache Tomcat servers vulnerable to CVE-2025-24813. The exploit achieves remote code execution by uploading a malicious serialized Java payload (generated via ysoserial or a custom Java class) to the Tomcat server's session directory using an HTTP PUT request. The script checks if the server is writable, generates the payload, uploads it, and verifies exploitation by checking for a server error indicative of deserialization. The script is operational and allows the attacker to specify the command to execute, the payload type, and other parameters. The main attack vector is network-based, requiring HTTP access to the target Tomcat server. The script is self-contained, with all logic in a single file, and is not part of a larger framework.

This repository provides a proof-of-concept (PoC) exploit for CVE-2025-24813, a remote code execution (RCE) vulnerability in Apache Tomcat. The main script, 'POC-Exploit_CVE_2025_24813.py', is an interactive Python tool that automates the exploitation process. It allows the user to specify a target URL, select the payload type (either a Java serialized object via ysoserial or a custom Java class), and input the command to execute on the target server. The script features advanced evasion techniques, such as anti-WAF header manipulation and payload fragmentation, and provides detailed per-target logging in the 'logs/' directory. Temporary files such as 'payload.ser' and Java class files are generated and cleaned up during execution. The exploit requires the attacker to have Java and ysoserial.jar available locally. The README.md offers comprehensive usage instructions, ethical guidelines, and a visual overview of the tool's architecture. The exploit is designed for authorized security testing and research purposes only.

This repository contains a Python proof-of-concept exploit for CVE-2025-24813. The main script, 'CVE-2025-24813-PoC.py', allows an attacker to upload a binary payload to a vulnerable web service using an HTTP PUT request, then trigger its execution via a GET request. The exploit decodes and executes a PowerShell command that downloads and runs a script from 'http://protonea.com:8000/script.ps1', effectively enabling remote code execution on the target. The script requires a local 'payload.bin' file and an interactsh URL for operation. The README provides usage instructions, environment details, and mitigation advice. No specific product is named in the documentation, but the exploit is clearly designed for remote exploitation of a web service vulnerable to CVE-2025-24813.

This repository contains a Go-based exploit tool, 'Apache_GoExploiter', targeting Apache Tomcat servers vulnerable to CVE-2025-24813. The main file, Apache_GoExploiter.go, implements a multithreaded scanner and exploit that tests a list of target hosts for HTTP PUT support on port 8080. It attempts to upload a test file to /log_err.txt and, if successful, tries to upload a JSP web shell to a variety of common writable directories (such as /uploads, /webdav, /images, etc.). The tool saves successful PUT and shell upload results to output files (PUT_VULN.txt and Shelled.txt). The payload is a JSP web shell that allows remote command execution via HTTP requests. The repository also includes a build script (build.sh) for compiling the tool for Windows and Linux, a README with usage instructions and CVE details, and standard project files. The exploit is operational and provides real-world attack capability against misconfigured Tomcat servers with PUT enabled and writable directories.

This repository provides a proof-of-concept exploit for CVE-2025-24813, a critical path equivalence vulnerability in Apache Tomcat. The vulnerability arises from inconsistent URL parsing, specifically with semicolons, allowing an attacker to bypass security constraints and execute arbitrary code if a JSP shell can be uploaded. The repository contains three files: a LICENSE, a detailed README.md explaining the vulnerability and attack chain, and a Python script (exploit.py) that demonstrates how to trigger the vulnerability. The exploit requires the attacker to know the path to an uploaded JSP shell and a valid endpoint on the server. The script crafts a malicious URL using path traversal and semicolon encoding to execute commands via the shell. The attack vector is network-based, targeting HTTP endpoints on a Tomcat server with a vulnerable configuration. No hardcoded IPs or domains are present; the script is parameterized for target URL and shell path. The exploit is a conceptual POC and does not include shell upload functionality.

This repository provides a Python-based proof-of-concept exploit for CVE-2025-24813, a remote code execution vulnerability in Apache Tomcat due to insecure session deserialization. The main file, 'cve_2025_24813_poc.py', is a command-line tool that supports both single and multiple target scanning. It automates the process of discovering valid session IDs by probing common Tomcat endpoints, then attempts to exploit the vulnerability by uploading a maliciously crafted Java serialized session file (generated via ysoserial) to the server. The tool tests multiple gadget chains for effectiveness and reports which ones succeed. It supports both Linux and Windows targets, provides verbose logging, and can disable SSL verification for HTTPS targets. The repository is structured with a single exploit script, a README with usage instructions, and a license file. The exploit requires Python 3.6+, Java, and ysoserial.jar. No hardcoded IPs or domains are present; all endpoints are relative paths used for session discovery and exploitation.

This repository provides a proof-of-concept exploit for CVE-2025-24813, a remote code execution vulnerability in Apache Tomcat. The exploit consists of a Python script ('exploit/1. exploit_cve_2025_24813.py') that abuses the HTTP PUT method to upload a malicious JSP web shell ('exploit/2. shell.jsp') to a Tomcat server. The Dockerfile in the 'docker/' directory sets up a vulnerable Tomcat environment for testing. The main exploit script uploads the web shell to 'http://localhost:8080/shell.jsp' and then verifies remote code execution by sending commands via the 'cmd' parameter. The repository is structured for ease of testing, with clear instructions and screenshots in the README. The exploit demonstrates how an attacker can gain remote command execution on improperly secured Tomcat instances by uploading and interacting with a web shell.

This repository contains a Python proof-of-concept exploit for CVE-2025-24813, a remote code execution vulnerability in Apache Tomcat. The exploit works by uploading a maliciously crafted Java serialized object as a session file via HTTP PUT to a writable directory on the target Tomcat server. The payload is generated using either ysoserial (with a specified gadget chain) or custom Java code, and is designed to execute arbitrary system commands on the server. After uploading, the exploit triggers deserialization by accessing the session file, which can result in code execution if the server is vulnerable. The repository consists of the main exploit script (CVE-2025-24813.py) and a README.md with usage instructions and vulnerability details. The exploit requires the attacker to specify the target URL and optionally customize the command to execute, the ysoserial path, gadget chain, and payload type. The attack vector is network-based, leveraging HTTP PUT and GET requests. The code is a functional PoC and does not include weaponized features such as automated payload customization or post-exploitation modules.

This repository provides a proof-of-concept exploit for CVE-2025-24813, targeting Apache Tomcat 9.0.98 with a vulnerable session persistence configuration. The repository contains three files: a Dockerfile to set up a vulnerable Tomcat environment, a context.xml file configuring Tomcat's session persistence to a specific directory, and exploit.py, a Python script that performs the exploit. The exploit works by generating a malicious Java serialized object using ysoserial (CommonsBeanutils1 gadget), uploading it as a session file to the Tomcat server, and then triggering deserialization by sending a request with a crafted JSESSIONID cookie. Successful exploitation results in remote code execution, demonstrated by creating the file /tmp/test123.txt on the server. The exploit requires network access to the Tomcat server (default: http://localhost:8080) and assumes the attacker can upload session files and trigger deserialization via HTTP requests.

This repository is a proof-of-concept (PoC) exploit for CVE-2025-24813, a Java deserialization remote code execution (RCE) vulnerability in Apache Tomcat. The main exploit logic is implemented in 'main.py', which automates the exploitation process: it checks if the target Tomcat server is writable via HTTP PUT, generates a malicious Java serialized payload (using ysoserial or a custom Java class), uploads the payload as a session file, and triggers deserialization to achieve arbitrary command execution on the server. The repository includes Dockerfiles for both the exploit environment and a vulnerable Tomcat test server, as well as supporting files for dependency management and payload generation. The exploit is configurable via command-line arguments, allowing the user to specify the target URL, command to execute, payload type, and ysoserial gadget chain. The attack vector is network-based, targeting Tomcat servers accessible over HTTP. The repository is well-structured for both demonstration and testing, and is intended for educational and authorized security testing purposes only.

This repository provides a ready-to-use environment for reproducing CVE-2025-24813, a remote code execution vulnerability in Apache Tomcat 9.0.98. The exploit leverages a combination of misconfigurations: enabling DefaultServlet write, supporting partial PUT requests, using file-based session persistence, and having a vulnerable deserialization gadget in the classpath (e.g., commons-collections). The attack involves uploading a malicious serialized Java object as a session file using a partial PUT request, then triggering deserialization by sending a GET request with a crafted JSESSIONID cookie. The repository includes a full Tomcat 9.0.98 distribution, configuration files, startup scripts for Linux and Windows, and documentation. The main exploit steps and required conditions are detailed in the top-level README.md. The environment is set up to allow easy testing of the exploit chain, but does not itself contain exploit code for generating the serialized payload; it expects the user to provide a suitable Java deserialization payload. The attack vector is network-based, targeting HTTP endpoints exposed by the Tomcat server. Notable endpoints include the main web interface and the session file upload path. The repository structure is typical for a Tomcat distribution, with additional documentation and sample applications for demonstration purposes.

This repository contains a Python exploit script (CVE-2025-24813.py) targeting Apache Tomcat versions 9.x and 10.x, exploiting a remote code execution vulnerability (CVE-2025-24813) via unsafe deserialization of session files. The exploit works by generating a malicious Java serialized payload (using ysoserial.jar), uploading it as a session file to the Tomcat server via an HTTP PUT request, and then triggering deserialization by accessing a JSP page. If successful, this results in arbitrary command execution on the server. The script requires the target to have a writable session directory accessible via HTTP PUT and the attacker to have Java and ysoserial.jar available. The repository also includes a brief README. The main exploit file is self-contained and operational, providing a clear attack chain and demonstrating the vulnerability.

This repository provides a proof-of-concept exploit for CVE-2025-24813, a remote code execution vulnerability in Apache Tomcat (versions 9.0.80–9.0.83 and 10.1.0–10.1.17). The exploit consists of a Python script (exploit.py) and a README.md with detailed usage instructions. The exploit works by uploading a malicious serialized Java object as a .session file to the Tomcat server's work directory using a partial HTTP PUT request with a Content-Range header. The exploit then triggers deserialization of this session by sending a GET request with a matching JSESSIONID cookie, resulting in arbitrary code execution. The script requires a pre-generated Java serialized payload (e.g., from ysoserial) and is intended for use against Tomcat servers configured with PersistentManager and FileStore. The main attack vector is network-based, targeting HTTP endpoints on the vulnerable Tomcat server.

This repository provides a working proof-of-concept exploit for CVE-2025-24813, a remote code execution vulnerability in Apache Tomcat (tested on version 9.0.90). The repository contains a Python script (cve_2025_24813.py) that automates the exploitation process, a Dockerfile for setting up a vulnerable Tomcat environment, a README with usage instructions, and a license file. The exploit works by first checking if the target Tomcat server allows HTTP PUT requests (indicating a writable web root), then generating a malicious Java serialized payload using ysoserial, uploading it as a session file, and finally triggering deserialization by sending a GET request with a custom JSESSIONID. Successful exploitation results in arbitrary command execution on the server. The script is interactive, requiring the user to provide the target URL, command to execute, path to ysoserial.jar, and the desired gadget chain. The attack vector is network-based, targeting Tomcat servers accessible over HTTP. The endpoints involved are the main application URL, a test file for PUT requests, the session file for payload upload, and the index.jsp endpoint to trigger the exploit. The exploit is operational and can be used to verify and demonstrate the vulnerability in real-world or test environments.

This repository provides a proof-of-concept (POC) exploit for CVE-2025-24813, targeting Apache Tomcat servers vulnerable to insecure Java session deserialization. The main exploit script, 'CVE-2025-24813.py', is a Python tool that sends a base64-encoded, Java-serialized payload (crafted to exploit a deserialization gadget chain such as CommonsBeanutils1) to the target server via an HTTP PUT request to the '/<session-id>/session' endpoint. It then triggers the deserialization by sending an HTTP GET request to '/' with a specially crafted JSESSIONID cookie. The exploit requires the target Tomcat instance to have specific vulnerable JARs (commons-beanutils, commons-collections, commons-logging) in its classpath, as described in the README. The payload can execute arbitrary commands on the server, demonstrated by creating a file '/tmp/success'. The repository is structured as a single exploit script with supporting IDE configuration files and a README that provides detailed setup and usage instructions, including how to prepare the vulnerable environment using Vulhub and generate the payload using ysoserial or ycpm.

This repository provides a Python proof-of-concept (PoC) exploit for Apache Tomcat's deserialization vulnerability (CVE-2025-24813). The main file, 'CVE-2025-24813-PoC.py', is an interactive command-line tool that allows the user to specify a target Tomcat server (IP, port, protocol), select a payload (default harmless or custom hex-encoded Java serialized object), and attempt exploitation. The exploit works by uploading a serialized session file to the Tomcat server using an HTTP PUT request, then accessing a JSP page with the crafted session ID to trigger deserialization. If the server is vulnerable, a 500 Internal Server Error indicates the deserialization was triggered, and if a malicious payload is used, this could result in remote code execution. The repository includes a README with usage instructions, a requirements.txt for dependencies, and an MIT license. No hardcoded IPs or domains are present; endpoints are constructed dynamically based on user input. The exploit is a PoC and does not include weaponized payloads by default, but supports user-supplied payloads for advanced testing.

This repository contains a Python proof-of-concept (POC) exploit for CVE-2025-24813, a remote code execution (RCE) vulnerability in Apache Tomcat (versions 9.0.0.M1-9.0.98, 10.1.0-M1-10.1.34, 11.0.0-M1-11.0.2). The main file, '2025/tomcat_2025.py', provides both version detection and exploitation capabilities. It uses HTTP PUT and GET requests to interact with the Tomcat server, targeting a session storage endpoint. The exploit generates a Java serialized payload using ysoserial (CommonsCollections5 chain) to achieve code execution, supporting three modes: launching calculator (Windows/Mac) or triggering a DNS request for out-of-band verification. The script requires the ysoserial-all.jar tool to be present in the working directory. The README provides usage instructions and vulnerability metadata. No hardcoded IPs or domains are present; endpoints are constructed from user-supplied arguments. The repository is structured as a single exploit script and a README, with clear targeting of Tomcat servers vulnerable to CVE-2025-24813.

This repository contains a proof-of-concept (PoC) exploit for CVE-2025-24813, a remote code execution (RCE) vulnerability in Apache Tomcat. The exploit is implemented in a single Python script (cve-2025-24813.py) and is accompanied by a detailed README.md. The exploit works by uploading a malicious serialized Java payload to a writable directory on the target Tomcat server (specifically, to a session file path such as /uploads/../sessions/{session_id}.session) using an HTTP PUT request. The payload is generated either via ysoserial (using a specified gadget chain) or by compiling a custom Java class. After uploading, the exploit triggers deserialization by making a GET request to the server (e.g., /index.jsp), which, if vulnerable, results in the execution of arbitrary commands on the server. The script checks for server writability, generates the payload, uploads it, and verifies exploitation by checking for specific HTTP responses. The repository is structured simply, with the main exploit logic in the Python script and usage instructions in the README. No hardcoded IPs or domains are present; all endpoints are relative and supplied by the user at runtime.

This repository provides a working exploit for CVE-2025-24813, a critical path traversal vulnerability in Apache Tomcat. The exploit consists of two main Python scripts: 1. CVE-2025-24813-Scanner.py: This script attempts to upload a simple JSP web shell to the target server using an HTTP PUT request to the path '/uploads/../webapps/ROOT/updates.jsp'. The payload is a JSP file that allows arbitrary command execution via a web form. The script supports both single and multiple targets (from a file). 2. CVE-2025-24813-Exploit.py: This script checks if the uploaded shell is accessible and functional by sending a request to '/updates.jsp' on the target and attempting to execute a command (default: 'cat /etc/passwd'). If successful, it confirms remote code execution and logs the vulnerable endpoint to 'pwned.txt'. The repository also includes a README.md with usage instructions, requirements, and a description of the vulnerability. The exploit is operational, providing a real web shell payload and automated exploitation workflow. The main attack vector is network-based, targeting web servers running vulnerable Apache Tomcat instances. The scripts are written in Python and require the 'requests' library.

This repository contains a proof-of-concept Python exploit script (CVE-2025-24813.py) and a README for CVE-2025-24813. The exploit targets a web service vulnerable to Java deserialization attacks. The script requires a target URL and a base64-encoded serialized Java payload (such as one generated by ysoserial or similar tools). It constructs a random endpoint path, uploads the payload via an HTTP PUT request, and then attempts to access the same endpoint with a specific session cookie to trigger the vulnerability. The README provides usage instructions and an example payload. The repository is structured simply, with one exploit script and documentation, and is intended for testing or demonstrating the vulnerability rather than weaponized exploitation.

This repository provides a proof-of-concept (POC) exploit for CVE-2025-24813, a deserialization vulnerability in Apache Tomcat (versions 9.0.0.M1-9.0.98, 10.1.0-M1-10.1.34, and 11.0.0-M1-11.0.2). The exploit leverages a misconfigured Tomcat instance (DefaultServlet 'readonly' set to false, file session persistence enabled, and a vulnerable deserialization gadget in the classpath) to achieve remote code execution via a crafted Java serialized payload. The main exploit script (poc.py) sends a base64-decoded serialized payload to the endpoint http://localhost:8080/pocss/session using an HTTP PUT request. The repository includes configuration files (context.xml, docker-compose.yml) to set up a vulnerable Tomcat environment, and detailed instructions in the README.md for generating payloads (using Java-Chains) and exploiting the target. The exploit is network-based and requires specific server-side configuration to be vulnerable. The payload achieves arbitrary code execution, such as spawning a reverse shell, if the exploit is successful.

This repository is a proof-of-concept (POC) exploit for CVE-2025-24813, targeting Apache Tomcat on Unix systems. It consists of two main Bash scripts and a README. The first script (01-prepare-environment.sh) automates the setup of a Tomcat environment: it downloads a specified Tomcat version, modifies configuration files to enable the vulnerable conditions, adds a deserialization gadget (commons-collections-3.1.jar), and prepares a Java deserialization payload using ysoserial. The second script (02-test.sh) generates or loads the payload and sends it via an HTTP PUT request to a Tomcat endpoint, attempting to exploit the vulnerability. Successful exploitation is indicated by the creation of a file in /tmp on the server. The repository is structured for easy testing of multiple Tomcat versions by changing a single variable. No weaponized or framework-based code is present; this is a standalone POC for vulnerability verification.

This repository provides a working exploit for CVE-2025-24813, a remote code execution (RCE) vulnerability in Apache Tomcat. The main exploit script, 'CVE_2025_24813.py', is a Python tool that targets a Tomcat server configured to allow writable session files and deserialization of attacker-controlled data. The exploit works by generating a malicious Java serialized payload (using ysoserial or a custom Java class), uploading it to the target server via HTTP PUT, and then triggering deserialization by making a crafted request with a specific session ID. If successful, arbitrary commands are executed on the server. The repository also includes a Dockerfile to set up a vulnerable Tomcat instance for testing, and a README with setup and usage instructions. The exploit is operational and allows for arbitrary command execution, making it a significant security risk for affected Tomcat deployments.

This repository is a complete lab environment for demonstrating exploitation of CVE-2025-24813, a Java unsafe deserialization vulnerability in a Tomcat-hosted web application. The structure includes Bash scripts to automate each step: building and running a vulnerable Tomcat container, generating a reverse shell payload using ysoserial (CommonsBeanutils1 gadget), uploading the payload via HTTP Partial PUT, and triggering deserialization via a GET request. The Java servlet (DeserializeServlet.java) reads and deserializes the uploaded session file, leading to code execution if a malicious object is provided. The exploit results in a reverse shell to the attacker's machine. The main endpoints are /xxx-api/gopan.session (for payload upload) and /xxx-api/profile (for deserialization trigger). The repository is operational and provides a working exploit chain, but is not weaponized for broad use. It is intended for educational and testing purposes.

This repository provides a working exploit for CVE-2025-24813, a remote code execution (RCE) vulnerability affecting Apache Tomcat under certain misconfigurations. The exploit consists of a single Python script ('exploit.py') and a README file. The script automates the process of generating multiple Java deserialization payloads using 'ysoserial-all.jar', each embedding a user-supplied command. It uploads these payloads as session files to the target Tomcat server via HTTP PUT requests to the '/gopan.session' endpoint. After uploading, it sends a GET request with a crafted cookie to trigger deserialization, aiming to execute the supplied command on the server. The exploit requires the attacker to have network access to the Tomcat server and assumes the server is both vulnerable and misconfigured to allow this attack path. The repository is operational and ready for use in security testing, provided the user supplies the required ysoserial JAR and appropriate command-line arguments.

This repository provides a proof-of-concept (PoC) exploit for CVE-2025-24813, a remote code execution (RCE) vulnerability in Apache Tomcat. The main file, 'CVE-2025-24813.py', is a Python script that targets a Tomcat server with specific insecure configurations (PUT/Write access enabled, session persistence, and required Java libraries). The exploit works by uploading a base64-encoded Java serialized payload (generated with ysoserial) to the server via HTTP PUT, then triggering its deserialization to achieve RCE. The payload, as provided, creates a file '/tmp/RCE-success' on the target to demonstrate successful exploitation. The README.md provides detailed setup instructions for configuring a vulnerable Tomcat environment and describes the expected output. The exploit is network-based, requiring only HTTP access to the target server, and is a functional PoC rather than a weaponized or framework-based exploit.

This repository provides a proof-of-concept exploit for CVE-2025-24813, targeting a Java web application running on Apache Tomcat 9.0.98. The exploit consists of a Dockerfile that sets up a Tomcat server with a vulnerable application (dummyapp-1.0-SNAPSHOT.war) and modifies the Tomcat web.xml to allow HTTP PUT and partial PUT requests, as well as disabling readonly mode. The application exposes a DeserializeServlet at the /profile endpoint, which is likely vulnerable to Java deserialization attacks. The upload.sh script uploads a serialized Java payload (payload.ser) in 100-byte chunks to the endpoint http://172.31.24.10:8080/xxx-api/gopan.session using HTTP PUT requests with Content-Range headers. The structure includes build artifacts and configuration files, with the main exploit logic in upload.sh and the Dockerfile. The purpose of the repository is to demonstrate and test exploitation of a deserialization vulnerability via chunked PUT requests to a Tomcat-hosted Java application.