The flaw exploits Apache Tomcat’s handling of partial PUT requests and path equivalence, allowing attackers to bypass security constraints and execute arbitrary code without authentication under specific conditions. Successful exploitation requires specific conditions, including write permissions for the default servlet, partial PUT support, and the use of file-based session persistence with a deserialization-vulnerable library. The rapid availability of proof-of-concept (PoC) exploits has lowered the barrier for exploitation, allowing even less sophisticated attackers to attempt to exploit this vulnerability. Active exploitation attempts have been observed globally, with attackers targeting systems primarily in the United States, Japan, India, South Korea, and Mexico. A critical vulnerability in Apache Tomcat has been actively exploited by attackers to achieve remote code execution (RCE) on vulnerable servers. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Then, a GET request is sent with a specially crafted “JSESSIONID” cookie, causing the server to deserialize the payload and execute arbitrary code.
This Cyber News was published on cybersecuritynews.com. Publication date: Sun, 30 Mar 2025 16:15:13 +0000