Description
Apache Tomcat是美国阿帕奇（Apache）基金会的一款轻量级Web应用服务器。用于实现对Servlet和JavaServer Page（JSP）的支持。 Apache Tomcat 11.0.0-M1至11.0.2版本、10.1.0-M1至10.1.34版本和9.0.0.M1至9.0.98版本存在环境问题漏洞。攻击者利用该漏洞可以远程执行代码或泄露敏感信息。
Apache Tomcat Partial PUT远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/middleware/Tomcat-%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E-CVE-2025-24813.md
https://jsut.openatom.tech/explore/journalism/detail/427334551119990784
https://avd.aliyun.com/detail?id=AVD-2025-24813
https://xxhc.shengda.edu.cn/info/1032/2299.htm
https://blog.csdn.net/qq_36703700/article/details/146248931
https://bbs.kanxue.com/thread-286023.htm
https://www.cnblogs.com/smileleooo/p/18772389
https://medium.com/cyberilluminati/apache-tomcat-partial-put-cve-2025-24813-rce-attempt-420786565659
https://cloud.tencent.com/document/product/1397/116839
https://www.gm7.org/archives/154
https://juejin.cn/post/7634085400539414543
https://unit42.paloaltonetworks.com/apache-cve-2025-24813-cve-2025-27636-cve-2025-29891/
https://www.centripetal.ai/threat-research/security-bulletin-remote-code-execution-with-partial-put-on-apache-tomcat-instances
https://nvd.nist.gov/vuln/detail/CVE-2025-24813
https://www.herodevs.com/blog-posts/cve-2025-24813-remote-code-execution-in-apache-tomcat-via-partial-put-path-equivalence
https://tomcat.apache.org/security-11.html
https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq
https://www.rapid7.com/blog/post/2025/03/19/etr-apache-tomcat-cve-2025-24813-what-you-need-to-know/