The attacker then sends a GET request with a JSESSIONID cookie pointing to the uploaded session file, forcing Tomcat to deserialize and execute the malicious Java code, granting complete control to the attacker. Tomcat users may also mitigate the problem by reverting to the default servlet configuration (readonly= "true"), turning off partial PUT support, and avoiding storing security-sensitive files in a subdirectory of public upload paths. The malicious activity was confirmed by Wallarm security researchers, who warned that traditional security tools fail to detect it as PUT requests appear normal and the malicious content is obfuscated using base64 encoding. Specifically, the attacker sends a PUT request containing a base64-encoded serialized Java payload saved to Tomcat's session storage. A critical remote code execution (RCE) vulnerability in Apache Tomcat tracked as CVE-2025-24813 is actively exploited in the wild, enabling attackers to take over servers with a simple PUT request. The attack does not require authentication and is caused by Tomcat accepting partial PUT requests and its default session persistence. Wallarm warns that the bigger issue highlighted in this case isn't the exploitation activity itself but the potential for more RCE vulnerabilities arising from the partial PUT handling in Tomcat. "Attackers will soon start shifting their tactics, uploading malicious JSP files, modifying configurations, and planting backdoors outside session storage. The security bulletin warned users that, under certain conditions, an attacker could view or inject arbitrary content on security-sensitive files. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. "The only requirement is that Tomcat is using file-based session storage, which is common in many deployments.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Mon, 17 Mar 2025 13:30:14 +0000