Overview
Apache Tomcat is an open-source web server and servlet container developed by the Apache Software Foundation. It implements several Java Enterprise Edition (Java EE) specifications including Java Servlet, JavaServer Pages (JSP), and WebSocket, allowing it to run Java web applications. Tomcat is widely used in both development and production environments due to its lightweight nature, ease of configuration, and compatibility with various Java applications.
An Authentication Bypass Using an Alternate Path or Channel vulnerability (CVE-2025-49125) has been identified in Apache Tomcat. This vulnerability exists when PreResources or PostResources are mounted other than in the applications root directory. PreResources and PostResources mount external resources, such as directories or JAR files, into the web application's classpath. This allows these external resources to be accessed by the web application as if they were part of its own structure.
Per OWASP: Confirmation of the user's identity, authentication, and session management is critical to protect against authentication-related attacks.
This issue affects multiple versions of Apache Tomcat below 11.0.8.
Details
Module Info
- Product: Apache Tomcat
- Affected packages: tomcat-embed-core, tomcat-catalina
- Affected versions: >=9.0.0.M1 <9.0.106, >=10.1.0-M1 <10.1.42, >=11.0.0-M1 <11.0.8
- GitHub repository: https://github.com/apache/tomcat
- Published packages:
- Package manager: Maven
- Fixed in: NES 8.5.101, 9.0.106, 10.1.42, and 11.0.8
Vulnerability Info
An attacker of a vulnerable application may access PreResources and PostResources that were mounted not in the root of the web application by referencing those resources through a crafted path with different security constraints.
A stricter isPathMounted() method now enforces that paths following the mount point must be separated by a slash, eliminating the “startsWith” confusion exploited previously.
Mitigation
Only recent versions of Apache Tomcat are community-supported. The community support version will not receive any updates to address this issue. For more information, see here.
Users of the affected components should apply one of the following mitigations:
- Upgrade to a patched version of Apache Tomcat.
- Leverage a commercial support partner like HeroDevs for post-EOL security support.
Credit
- Greg K (https://github.com/gregk4sec) (finder)
