Apache Under the Lens: Tomcat’s Partial PUT and Camel’s Header Hijack
Summary: In March 2025, Apache disclosed CVE-2025-24813 in Tomcat, a remote code execution flaw affecting versions 9.0.0.M1 through 9.0.98, 10.1.0-M1 through 10.1.34, and 11.0.0-M1 through 11.0.2, alongside two Camel flaws, CVE-2025-27636 and CVE-2025-29891, affecting versions 4.10.0 to 4.10.1, 4.8.0 to 4.8.4, and 3.10.0 to 3.22.3. Palo Alto Networks blocked 125,856 probes, scans, and exploit attempts tied to these vulnerabilities in March 2025, originating from more than 70 countries, with activity peaking within the first week after the exploits were announced.
Why it matters: The Tomcat flaw lets an attacker write a malicious serialized session file via a partial PUT request and trigger deserialization with a single follow-up GET, so a server that persists sessions is exploitable in two requests. With 125,856 attempts from over 70 countries in one month and PoC exploits published alongside the patches, the window between disclosure and scanning was effectively zero.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-24813CVE-2025-27636CVE-2025-29891
- Related
- CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability Known Exploited Vulnerabilities · Apr 01, 2025