# Apache Tomcat RCE via partial PUT requests

Published: 2026-06-09 · Severity: high · Sectors: technology
Canonical: https://vorant.io/reports/19037bfe-08d4-5266-b2f4-2104e0b86d93/apache-tomcat-rce-via-partial-put-requests

> CVE-2025-24813 in Apache Tomcat allows remote code execution through PUT requests; proof-of-concept code is public.

Apache Tomcat versions 9.0.0-M1 through 9.0.98, 10.1.0-M1 through 10.1.34, and 11.0.0-M1 through 11.0.2 contain a remote code execution vulnerability in the partial PUT request implementation. The flaw allows an attacker to execute arbitrary code via a crafted PUT request when specific conditions are met: writes are enabled on the default servlet (disabled by default), partial PUT support is enabled (enabled by default), the application uses file-based session persistence with default storage location, and the application includes a library vulnerable to deserialization attacks.

Proof-of-concept exploitation code has been published on GitHub, indicating active weaponization. Successful exploitation grants an attacker code execution in the context of the Tomcat process, allowing installation of programs, data theft, modification or deletion depending on system privileges. Defenders should prioritize patching affected versions immediately and consider disabling partial PUT requests if not operationally required to reduce attack surface. Running Tomcat with least privilege (non-root user) will limit the impact of successful exploitation.

## Mentioned in this report

- Vulnerabilities: CVE-2025-24813 (KEV)

## Detection guidance (public sample)

### Tomcat Partial PUT Writing .session File (CVE-2025-24813)

ATT&CK: T1190

Detects HTTP PUT requests that write a .session file via the default servlet and succeed, the first stage of the Tomcat partial PUT deserialization RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Tomcat Partial PUT Writing .session File (CVE-2025-24813)
description: Detects successful HTTP PUT requests to a URI ending in .session. In
  the Tomcat partial PUT RCE, the attacker uploads a serialized payload that Tomcat
  stores as a session file, so the target resource name ends in .session. Normal clients
  do not PUT session files.
tags:
- attack.initial-access
- attack.t1190
- cve.2025-24813
logsource:
  category: webserver
detection:
  selection:
    cs-method: PUT
    cs-uri-stem|endswith: .session
    sc-status:
    - 200
    - 201
    - 204
  condition: selection
falsepositives:
- WebDAV or custom upload applications that deliberately store files with a .session
  extension
level: high
id: 61ef63ce-e1a7-5fe1-b16b-7cf08d6e694c
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-apache-tomcat-could-allow-for-remote-code-execution_2025-027
```

### Tomcat Request With Dot-Prefixed JSESSIONID Cookie

ATT&CK: T1190

Detects requests whose JSESSIONID cookie value begins with a dot, used to trigger deserialization of an attacker-uploaded session file in Tomcat. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Tomcat Request With Dot-Prefixed JSESSIONID Cookie
description: Detects web requests whose JSESSIONID cookie value starts with a dot.
  After uploading a malicious session file through a partial PUT, the attacker sends
  a request with a JSESSIONID that references that file (path separators converted
  to dots) to force Tomcat to deserialize it. Legitimate session IDs are alphanumeric
  and never start with a dot.
tags:
- attack.initial-access
- attack.t1190
- cve.2025-24813
logsource:
  category: webserver
detection:
  selection:
    cs-cookie|contains: JSESSIONID=.
  condition: selection
falsepositives:
- Security scanners or penetration tests probing for CVE-2025-24813
level: high
id: bd660cd8-6f5f-5bad-8d2a-b35c1d9e46ed
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-apache-tomcat-could-allow-for-remote-code-execution_2025-027
```

### Tomcat Service Process Spawning Shell or Recon Utility

ATT&CK: T1190

Detects a Windows Tomcat service process spawning a command interpreter or common recon tool, indicating possible post-exploitation code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Tomcat Service Process Spawning Shell or Recon Utility
description: Detects the Windows Tomcat service executable (tomcatN.exe) spawning
  cmd, PowerShell or common reconnaissance utilities. Successful deserialization RCE
  such as CVE-2025-24813 gives code execution in the Tomcat process context, which
  commonly leads to shell child processes.
tags:
- attack.initial-access
- attack.t1190
- cve.2025-24813
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \tomcat7.exe
    - \tomcat8.exe
    - \tomcat9.exe
    - \tomcat10.exe
    - \tomcat11.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \whoami.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \net.exe
    - \net1.exe
    - \nltest.exe
    - \mshta.exe
  condition: selection_parent and selection_child
falsepositives:
- Applications hosted in Tomcat that intentionally run batch scripts via cmd.exe
- Administrative maintenance scripts launched by the Tomcat service
level: medium
id: a2a87fef-17d6-5e31-9b8d-a16ad2d4ac76
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-apache-tomcat-could-allow-for-remote-code-execution_2025-027
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-apache-tomcat-could-allow-for-remote-code-execution_2025-027

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/19037bfe-08d4-5266-b2f4-2104e0b86d93/apache-tomcat-rce-via-partial-put-requests.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup