CVE-2025-55752

Overview

Apache Tomcat is an open-source web server and servlet container developed by the Apache Software Foundation. It implements several Java Enterprise Edition (Java EE) specifications including Java Servlet, JavaServer Pages (JSP), and WebSocket, allowing it to run Java web applications. Tomcat is widely used in both development and production environments due to its lightweight nature, ease of configuration, and compatibility with various Java applications. 

‍

A Path Traversal vulnerability (CVE-2025-55752) has been identified in Apache Tomcat. A bugfix caused this regression where the rewritten URL gets normalized before being decoded.

‍

The Open Web Application Security Project (OWASP) explains that Path Traversal attacks aim to access files and directories that are outside the web root folder.

‍

This issue affects multiple versions of Apache Tomcat below 11.0.11.

‍

Details

Module Info

• Product: Apache Tomcat
• Affected packages: tomcat, tomcat-catalina, tomcat-embed-core
• Affected versions: >=8.5.6 <=8.5.100, >=9.0.0.M11 <9.0.109, >=10.1.0-M1 <10.1.45, >=11.0.0-M1 <11.0.11
• GitHub repository: https://github.com/apache/tomcat

• Published packages:
  
  • https://central.sonatype.com/artifact/org.apache.tomcat/tomcat
  • https://central.sonatype.com/artifact/org.apache.tomcat/tomcat-catalina
  • https://central.sonatype.com/artifact/org.apache.tomcat.embed/tomcat-embed-core

• Package manager: Maven
• Fixed in: NES for Tomcat 8.5.103

‍

Vulnerability Info

An attacker can exploit a vulnerable application through rewrite rules. In vulnerable applications, rewritten URLs are normalized before they are decoded. This made it possible for attackers to manipulate request URIs to bypass security constraints for files such as /WEB-INF/ and /META-INF/ through rewrite rules that rewrite query parameters to the URL.

‍

Additionally, if PUT requests are enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulates the URI.

‍

Mitigation

Only recent versions of Apache Tomcat are community-supported. The community support version will not receive any updates to address this issue. For more information, see here.

‍

Users of the affected components should apply one of the following mitigations:

• Upgrade to a patched version of Apache Tomcat.
• Disable unnecessary PUT requests to minimize the attack potential and audit the permissions of users that can use PUT requests that may also be used in conjunction with rewrite rules.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credit

• Chumy Tsai (github.com/Jimmy01240397) @ CyCraft Technology Intern

‍

‍

‍