253 lines
14 KiB
JSON
253 lines
14 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.1",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2025-24813",
|
||
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "apache",
|
||
"dateReserved": "2025-01-24T08:51:50.296Z",
|
||
"datePublished": "2025-03-10T16:44:03.715Z",
|
||
"dateUpdated": "2025-10-29T11:49:44.413Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"affected": [
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "Apache Tomcat",
|
||
"vendor": "Apache Software Foundation",
|
||
"versions": [
|
||
{
|
||
"lessThanOrEqual": "11.0.2",
|
||
"status": "affected",
|
||
"version": "11.0.0-M1",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"lessThanOrEqual": "10.1.34",
|
||
"status": "affected",
|
||
"version": "10.1.0-M1",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"lessThanOrEqual": "9.0.98",
|
||
"status": "affected",
|
||
"version": "9.0.0.M1",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"lessThanOrEqual": "8.5.100",
|
||
"status": "affected",
|
||
"version": "8.5.0",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"lessThan": "8.5.0",
|
||
"status": "unknown",
|
||
"version": "3",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"lessThanOrEqual": "10.0.27",
|
||
"status": "unknown",
|
||
"version": "10.0.0-M1",
|
||
"versionType": "semver"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"type": "finder",
|
||
"value": "COSCO Shipping Lines DIC"
|
||
},
|
||
{
|
||
"lang": "en",
|
||
"type": "finder",
|
||
"value": "sw0rd1ight (https://github.com/sw0rd1ight)"
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "<p>Path Equivalence: 'file.Name' (Internal Dot) leading to <span style=\"background-color: var(--wht);\">Remote Code Execution and/or Information disclosure </span><span style=\"background-color: var(--wht);\">and/or malicious content added to uploaded files via write enabled </span><span style=\"background-color: var(--wht);\">Default Servlet</span> in Apache Tomcat.</p><p>This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.<br>The following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.<br></p><div><p>If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:<br>- <span style=\"background-color: var(--wht);\">writes enabled for the default servlet (disabled by default)<br></span><span style=\"background-color: var(--wht);\">- support for partial PUT (enabled by default)<br></span><span style=\"background-color: var(--wht);\">- a target URL for security sensitive uploads that was a sub-directory of </span><span style=\"background-color: var(--wht);\">a target URL for public uploads<br>- </span><span style=\"background-color: var(--wht);\">attacker knowledge of the names of security sensitive files being </span><span style=\"background-color: var(--wht);\">uploaded<br>- </span><span style=\"background-color: var(--wht);\">the security sensitive files also being uploaded via partial PUT</span></p><p><span style=\"background-color: var(--wht);\">If all of the following were true, a malicious user was able to</span> perform remote code execution:<br><span style=\"background-color: var(--wht);\">- writes enabled for the default servlet (disabled by default)<br>- </span><span style=\"background-color: var(--wht);\">support for partial PUT (enabled by default)<br>- </span><span style=\"background-color: var(--wht);\">application was using Tomcat's file based session persistence with the </span><span style=\"background-color: var(--wht);\">default storage location<br>- </span><span style=\"background-color: var(--wht);\">application included a library that may be leveraged in a </span><span style=\"background-color: var(--wht);\">deserialization attack</span></p><p><span style=\"background-color: var(--wht);\">Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.</span></p></div>"
|
||
}
|
||
],
|
||
"value": "Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nIf all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads\n- attacker knowledge of the names of security sensitive files being uploaded\n- the security sensitive files also being uploaded via partial PUT\n\nIf all of the following were true, a malicious user was able to perform remote code execution:\n- writes enabled for the default servlet (disabled by default)\n- support for partial PUT (enabled by default)\n- application was using Tomcat's file based session persistence with the default storage location\n- application included a library that may be leveraged in a deserialization attack\n\nUsers are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"content": {
|
||
"text": "important"
|
||
},
|
||
"type": "Textual description of severity"
|
||
}
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-44",
|
||
"description": "CWE-44 Path Equivalence: 'file.name' (Internal Dot)",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-502",
|
||
"description": "CWE-502 Deserialization of Untrusted Data",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
|
||
"shortName": "apache",
|
||
"dateUpdated": "2025-10-29T11:49:44.413Z"
|
||
},
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"vendor-advisory"
|
||
],
|
||
"url": "https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq"
|
||
}
|
||
],
|
||
"source": {
|
||
"discovery": "UNKNOWN"
|
||
},
|
||
"title": "Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT",
|
||
"x_generator": {
|
||
"engine": "Vulnogram 0.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2025-07-21T17:13:17.168Z"
|
||
},
|
||
"references": [
|
||
{
|
||
"url": "http://www.openwall.com/lists/oss-security/2025/03/10/5"
|
||
},
|
||
{
|
||
"url": "https://www.vicarius.io/vsociety/posts/cve-2025-24813-detect-apache-tomcat-rce"
|
||
},
|
||
{
|
||
"url": "https://www.vicarius.io/vsociety/posts/cve-2025-24813-mitigate-apache-tomcat-rce"
|
||
},
|
||
{
|
||
"url": "https://security.netapp.com/advisory/ntap-20250321-0001/"
|
||
},
|
||
{
|
||
"url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00003.html"
|
||
},
|
||
{
|
||
"url": "https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-detect-vulnerability"
|
||
},
|
||
{
|
||
"url": "https://www.vicarius.io/vsociety/posts/cve-2025-24813-tomcat-mitigation-vulnerability"
|
||
}
|
||
],
|
||
"title": "CVE Program Container",
|
||
"x_generator": {
|
||
"engine": "ADPogram 0.0.1"
|
||
}
|
||
},
|
||
{
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"scope": "CHANGED",
|
||
"version": "3.1",
|
||
"baseScore": 10,
|
||
"attackVector": "NETWORK",
|
||
"baseSeverity": "CRITICAL",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
|
||
"integrityImpact": "HIGH",
|
||
"userInteraction": "NONE",
|
||
"attackComplexity": "LOW",
|
||
"availabilityImpact": "HIGH",
|
||
"privilegesRequired": "NONE",
|
||
"confidentialityImpact": "HIGH"
|
||
}
|
||
},
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"id": "CVE-2025-24813",
|
||
"role": "CISA Coordinator",
|
||
"options": [
|
||
{
|
||
"Exploitation": "active"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "total"
|
||
}
|
||
],
|
||
"version": "2.0.3",
|
||
"timestamp": "2025-04-01T19:37:06.207441Z"
|
||
}
|
||
}
|
||
},
|
||
{
|
||
"other": {
|
||
"type": "kev",
|
||
"content": {
|
||
"dateAdded": "2025-04-01",
|
||
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24813"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://github.com/absholi7ly/POC-CVE-2025-24813/blob/main/README.md",
|
||
"tags": [
|
||
"exploit"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24813",
|
||
"tags": [
|
||
"government-resource"
|
||
]
|
||
}
|
||
],
|
||
"timeline": [
|
||
{
|
||
"time": "2025-04-01T00:00:00.000Z",
|
||
"lang": "en",
|
||
"value": "CVE-2025-24813 added to CISA KEV"
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2025-10-21T22:55:25.563Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |