Wallarm security researchers have confirmed active exploitation attempts, warning that traditional security tools fail to detect these attacks because the PUT requests appear normal and malicious content is obfuscated using base64 encoding. The critical flaw affects multiple versions of Apache Tomcat: 11.0.0-M1 to 11.0.2, 10.1.0-M1 to 10.1.34, and 9.0.0.M1 to 9.0.98. First disclosed by Apache on March 10, 2025, the vulnerability allows attackers to view or inject arbitrary content on security-sensitive files under specific conditions. Security researchers have confirmed that a critical remote code execution (RCE) vulnerability in Apache Tomcat, tracked as CVE-2025-24813, is being actively exploited in the wild. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The rapid exploitation of this vulnerability highlights the critical importance of proactive security measures and prompt patching in today’s threat landscape. Security experts warn that this is likely just the beginning, as attackers will soon evolve their tactics beyond session storage exploitation. “Attackers will soon start shifting their tactics, uploading malicious JSP files, modifying configurations, and planting backdoors outside session storage. The vulnerability, which enables attackers to take control of servers with a simple PUT request, was disclosed last week, and proof-of-concept exploits were published on GitHub merely 30 hours later. This request appears innocuous to most security filters, as the malicious payload is effectively hidden through encoding. The attacker sends a PUT request containing a base64-encoded serialized Java payload, which gets saved to Tomcat’s session storage. Once the malicious file is uploaded, the attacker sends a GET request with a JSESSIONID cookie pointing to the uploaded session file. Most security tools don’t deeply inspect uploaded files or track multi-step attacks. This forces Tomcat to deserialize and execute the malicious Java code, granting complete control to the attacker. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 18 Mar 2025 04:55:14 +0000