'Dead simple' RCE exploit in Apache Tomcat under attack

Updated A trivial flaw in Apache Tomcat that allows remote code execution and access to sensitive files is said to be under attack in the wild within a week of its disclosure. The vulnerability is CVE-2025-24813, and was revealed on March 10 along with updates to close the hole in the open source web server software. According to API security shop Wallarm, an exploit for the bug was publicly distributed 30 hours later, and is “now actively exploited in the wild.” Authentication is not required to pull off an attack, and the end result is the ability to run arbitrary code on the targeted Tomcat server by miscreants, allowing them to access data among other nefarious things. "We've already seen this in operation by Chinese operators, and CISA [The US government's Cybersecurity and Infrastructure Security Agency] got in touch tonight and are going to add the exploit to its warning list," Ivan Novikov, Wallarm's CEO, told The Register. According to a Wallarm advisory about the flaw, the only requirement for successful exploitation “is that Tomcat is using file-based session storage, which is common in many deployments.” “The attacker starts by sending a PUT request to upload a malicious session file to the server,” Wallarm’s advisory explains. "The payload is a base64-encoded ysoserial gadget chain, designed to trigger remote code execution when deserialized. This request writes a file inside Tomcat’s session storage directory. Because Tomcat automatically saves session data in f...