Apache Tomcat RCE via partial PUT requests
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CVE-2025-24813 in Apache Tomcat allows remote code execution through PUT requests; proof-of-concept code is public.
Apache Tomcat versions 9.0.0-M1 through 9.0.98, 10.1.0-M1 through 10.1.34, and 11.0.0-M1 through 11.0.2 contain a remote code execution vulnerability in the partial PUT request implementation. The flaw allows an attacker to execute arbitrary code via a crafted PUT request when specific conditions are met: writes are enabled on the default servlet (disabled by default), partial PUT support is enabled (enabled by default), the application uses file-based session persistence with default storage location, and the application includes a library vulnerable to deserialization attacks.
Proof-of-concept exploitation code has been published on GitHub, indicating active weaponization. Successful exploitation grants an attacker code execution in the context of the Tomcat process, allowing installation of programs, data theft, modification or deletion depending on system privileges. Defenders should prioritize patching affected versions immediately and consider disabling partial PUT requests if not operationally required to reduce attack surface. Running Tomcat with least privilege (non-root user) will limit the impact of successful exploitation.
Mentioned in this report
Detection guidance
Tomcat Partial PUT Writing .session File (CVE-2025-24813)
Detects HTTP PUT requests that write a .session file via the default servlet and succeed, the first stage of the Tomcat partial PUT deserialization RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Tomcat Partial PUT Writing .session File (CVE-2025-24813)
description: Detects successful HTTP PUT requests to a URI ending in .session. In
the Tomcat partial PUT RCE, the attacker uploads a serialized payload that Tomcat
stores as a session file, so the target resource name ends in .session. Normal clients
do not PUT session files.
tags:
- attack.initial-access
- attack.t1190
- cve.2025-24813
logsource:
category: webserver
detection:
selection:
cs-method: PUT
cs-uri-stem|endswith: .session
sc-status:
- 200
- 201
- 204
condition: selection
falsepositives:
- WebDAV or custom upload applications that deliberately store files with a .session
extension
level: high
id: 61ef63ce-e1a7-5fe1-b16b-7cf08d6e694c
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-apache-tomcat-could-allow-for-remote-code-execution_2025-027
Tomcat Request With Dot-Prefixed JSESSIONID Cookie
Detects requests whose JSESSIONID cookie value begins with a dot, used to trigger deserialization of an attacker-uploaded session file in Tomcat. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Tomcat Request With Dot-Prefixed JSESSIONID Cookie
description: Detects web requests whose JSESSIONID cookie value starts with a dot.
After uploading a malicious session file through a partial PUT, the attacker sends
a request with a JSESSIONID that references that file (path separators converted
to dots) to force Tomcat to deserialize it. Legitimate session IDs are alphanumeric
and never start with a dot.
tags:
- attack.initial-access
- attack.t1190
- cve.2025-24813
logsource:
category: webserver
detection:
selection:
cs-cookie|contains: JSESSIONID=.
condition: selection
falsepositives:
- Security scanners or penetration tests probing for CVE-2025-24813
level: high
id: bd660cd8-6f5f-5bad-8d2a-b35c1d9e46ed
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-apache-tomcat-could-allow-for-remote-code-execution_2025-027
Tomcat Service Process Spawning Shell or Recon Utility
Detects a Windows Tomcat service process spawning a command interpreter or common recon tool, indicating possible post-exploitation code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Tomcat Service Process Spawning Shell or Recon Utility
description: Detects the Windows Tomcat service executable (tomcatN.exe) spawning
cmd, PowerShell or common reconnaissance utilities. Successful deserialization RCE
such as CVE-2025-24813 gives code execution in the Tomcat process context, which
commonly leads to shell child processes.
tags:
- attack.initial-access
- attack.t1190
- cve.2025-24813
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \tomcat7.exe
- \tomcat8.exe
- \tomcat9.exe
- \tomcat10.exe
- \tomcat11.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \whoami.exe
- \certutil.exe
- \bitsadmin.exe
- \net.exe
- \net1.exe
- \nltest.exe
- \mshta.exe
condition: selection_parent and selection_child
falsepositives:
- Applications hosted in Tomcat that intentionally run batch scripts via cmd.exe
- Administrative maintenance scripts launched by the Tomcat service
level: medium
id: a2a87fef-17d6-5e31-9b8d-a16ad2d4ac76
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-apache-tomcat-could-allow-for-remote-code-execution_2025-027
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-apache-tomcat-could-allow-for-remote-code-execution_2025-027
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs