id: CVE-2025-24813-insikt

info:
  name: CVE-2025-24813 Apache Tomcat path equivalence vulnerability
  author: ACHA, Insikt Group, Recorded Future
  severity: critical
  description: |
    Detects that Apache Tomcat versions 11.0.0-M1 to 11.0.2, 10.1.0-M1 to 10.1.34, and 9.0.0.M1 to 9.0.98 are vulnerable to a path equivalence vulnerability. Additionally, Insikt Group's analysis found that 8.5.x versions (specifically 8.5.0 to 8.5.98 and 8.5.100, with the exception of 8.5.99) are also vulnerable, though they were not included in the initial set of affected products by Apache.
  impact: |
    Under specific conditions, successfully exploiting the vulnerability can allow attackers to view security sensitive files, inject content into those files, and conduct remote code execution (RCE).
  remediation: |
    Upgrade to Apache Tomcat version 11.0.3 or later, 10.1.35 or later, and 9.0.99 or later. For end-of-life (EoL) 8.5.x versions, upgrade to a supported branch of Apache Tomcat. If upgrading is not immediately possible, consider implementing network-level controls to restrict access to the Tomcat server.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-24813
    - https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq
    - https://www.openwall.com/lists/oss-security/2025/03/10/5
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-24813
    cwe-id:
      - CWE-706 # Use of Incorrectly-Resolved Name or Reference
      - CWE-502 # Deserialization of Untrusted Data
      - CWE-44 # Path Equivalence: 'file.name' (Internal Dot)
  metadata:
    verified: true
    max-request: 3
    date: 2025-03-26
    last-updated: 2025-03-26
    unique-rule-id: 07549d83-a7aa-4931-9698-87c44769d754
    mitre-att&ck:
      - attack.t1190 # Exploit Public Facing Application
      - attack.t1203 # Exploitation for Client Execution
      - attack.t1659 # Content Injection
      - attack.t1083 # File and Directory Discovery
      - attack.t1027 # Obfuscated Files or Information
    shodan-query: title:"Apache Tomcat"
    vendor: Apache
    product: Tomcat
  tags: cve,cve2025,apache,rce

http:
  - method: GET
    path:
      - "{{BaseURL}}"
      - "{{BaseURL}}/{{randstr}}"
      - "{{BaseURL}}/docs/introduction.html"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(body), "apache tomcat")'
          - 'contains(tolower(body), "/manager/html")'
          - 'contains(tolower(body), "/manager/status")'
          - 'contains(tolower(header), "tomcat")'
        condition: or

      - type: regex
        regex:
          - (?i)Apache Tomcat.*\b11\.0\.0-M([1-9][0-9]?|100)\b
          - (?i)Apache Tomcat.*\b11\.0\.1\b
          - (?i)Apache Tomcat.*\b11\.0\.2\b
          - (?i)Apache Tomcat.*\b10\.1\.0-M([1-9][0-9]?|100)\b
          - (?i)Apache Tomcat.*\b10\.1\.(?:[1-9]|[1-2][0-9]|3[0-4])\b
          - (?i)Apache Tomcat.*\b9\.0\.0-M([1-9][0-9]?|100)\b
          - (?i)Apache Tomcat.*\b9\.0\.(?:[1-9]|[1-9][0-9])\b
          - (?i)Apache Tomcat.*\b8\.5\.(?:[0-9]|[1-9][0-8])\b
          - (?i)Apache Tomcat.*\b8\.5\.100\b
        condition: or

    extractors:
      - type: regex
        name: version
        group: 1
        regex:
          - '(?i)Apache Tomcat.*\D([1-9]*[0-9]\.[0-9]+\.[0-9]+)'
