CVE-2025-55754

Overview

Apache Tomcat is an open-source web server and servlet container developed by the Apache Software Foundation. It implements several Java Enterprise Edition (Java EE) specifications including Java Servlet, JavaServer Pages (JSP), and WebSocket, allowing it to run Java web applications. Tomcat is widely used in both development and production environments due to its lightweight nature, ease of configuration, and compatibility with various Java applications. 

‍

A Command Injection vulnerability (CVE-2025-55754) has been identified in Apache Tomcat on Windows.

‍

The Open Web Application Security Project (OWASP) explains that Command Injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell.

‍

This issue affects multiple versions of Apache Tomcat below 11.0.11.

‍

Details

Module Info

• Product: Apache Tomcat
• Affected packages: tomcat, tomcat-catalina, tomcat-embed-core
• Affected versions: >=8.5.60 <=8.5.100, >=9.0.40 <9.0.109, >=10.1.0-M1 <10.1.45, >=11.0.0-M1 <11.0.11
• GitHub repository: https://github.com/apache/tomcat

• Published packages:
  
  • https://central.sonatype.com/artifact/org.apache.tomcat/tomcat
  • https://central.sonatype.com/artifact/org.apache.tomcat/tomcat-catalina
  • https://central.sonatype.com/artifact/org.apache.tomcat.embed/tomcat-embed-core

• Package manager: Maven
• Fixed in: NES for Tomcat 8.5.103

‍

Vulnerability Info

This vulnerability hinges on Tomcat not escaping ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command.

‍

Mitigation

Only recent versions of Apache Tomcat are community-supported. The community support version will not receive any updates to address this issue. For more information, see here.

‍

Users of the affected components should apply one of the following mitigations:

• Upgrade to a patched version of Apache Tomcat.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credit

• Elysee Franchuk of MOBIA Technology Innovations

‍