SoFunction
Updated on 2025-04-17

SpringBoot Tomcat vulnerability fix

Apache Tomcat Remote Code Execution Vulnerability (CVE-2025-24813)

Tomcat is an open source, lightweight web application server and Servlet container. It is developed by the Jakarta project under the Apache Software Foundation and is one of the most popular Java Web servers at present.

The exploitation conditions are relatively complex and the following four conditions must be met at the same time:

  • The application has enabled the DefaultServlet write function, which is turned off by default.
  • The application supports partial PUT requests, which can write malicious serialized data into the session file. This function is enabled by default.
  • The application uses Tomcat's file session persistence and uses the default session storage location, which requires additional configuration.
  • The application contains a library with deserialization vulnerabilities, such as commons-collections present in the classpath. This condition depends on whether the business implementation depends on the library with deserialization utilization chain.

Vulnerability Threat Level: High Risk

Affected version

11.0.0-M1 <= Apache Tomcat <= 11.0.2
10.1.0-M1 <= Apache Tomcat <= 10.1.34
9.0.0.M1 <= Apache Tomcat <= 9.0.98

Safe version

Apache Tomcat >= 11.0.3
Apache Tomcat >= 10.1.35
Apache Tomcat >= 9.0.99

Key configurations

Project structure

demo_project
├─module
│  ├─src
│  │  └─main
|  └─
└─

Under the project root path

&lt;?xml version="1.0" encoding="UTF-8"?&gt;
&lt;project xmlns="/POM/4.0.0"
         xmlns:xsi="http:///2001/XMLSchema-instance"
         xsi:schemaLocation="/POM/4.0.0 /xsd/maven-4.0."&gt;
	&lt;modelVersion&gt;4.0.0&lt;/modelVersion&gt;

  &lt;groupId&gt;&lt;/groupId&gt;
  &lt;artifactId&gt;demo&lt;/artifactId&gt;
  &lt;version&gt;1.0.0&lt;/version&gt;

  &lt;name&gt;demo&lt;/name&gt;
  &lt;description&gt;demo&lt;/description&gt;

  &lt;properties&gt;
    &lt;&gt;1.0.0&lt;/&gt;
    &lt;&gt;UTF-8&lt;/&gt;
    &lt;&gt;UTF-8&lt;/&gt;
    &lt;&gt;1.8&lt;/&gt;
    
    &lt;&gt;9.0.99&lt;/&gt;
    &lt;&gt;1.3.5&lt;/&gt;
  &lt;/properties&gt;

  &lt;!-- Dependency Statement --&gt;
  &lt;dependencyManagement&gt;
    &lt;dependencies&gt;
      &lt;!-- SpringBootDependency configuration--&gt;
      &lt;dependency&gt;
        &lt;groupId&gt;&lt;/groupId&gt;
        &lt;artifactId&gt;spring-boot-dependencies&lt;/artifactId&gt;
        &lt;version&gt;2.5.14&lt;/version&gt;
        &lt;type&gt;pom&lt;/type&gt;
        &lt;scope&gt;import&lt;/scope&gt;
      &lt;/dependency&gt;

      &lt;!-- solveApache Tomcat Remote code execution vulnerability(CVE-2025-24813)--&gt;
      &lt;dependency&gt;
        &lt;groupId&gt;&lt;/groupId&gt;
        &lt;artifactId&gt;tomcat-embed-core&lt;/artifactId&gt;
        &lt;version&gt;${}&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
        &lt;groupId&gt;&lt;/groupId&gt;
        &lt;artifactId&gt;tomcat-embed-el&lt;/artifactId&gt;
        &lt;version&gt;${}&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
        &lt;groupId&gt;&lt;/groupId&gt;
        &lt;artifactId&gt;tomcat-embed-websocket&lt;/artifactId&gt;
        &lt;version&gt;${}&lt;/version&gt;
        &lt;exclusions&gt;
          &lt;exclusion&gt;
            &lt;artifactId&gt;tomcat-annotations-api&lt;/artifactId&gt;
            &lt;groupId&gt;&lt;/groupId&gt;
          &lt;/exclusion&gt;
        &lt;/exclusions&gt;
      &lt;/dependency&gt;
        &lt;dependency&gt;
          &lt;groupId&gt;&lt;/groupId&gt;
          &lt;artifactId&gt;-api&lt;/artifactId&gt;
          &lt;version&gt;${}&lt;/version&gt;
        &lt;/dependency&gt;
    &lt;/dependencies&gt;
  &lt;/dependencyManagement&gt;

  &lt;modules&gt;
    &lt;module&gt;module&lt;/module&gt;
  &lt;/modules&gt;

  &lt;packaging&gt;pom&lt;/packaging&gt;

  &lt;dependencies&gt;
  &lt;/dependencies&gt;

  &lt;build&gt;
      &lt;plugins&gt;
        &lt;plugin&gt;
          &lt;groupId&gt;&lt;/groupId&gt;
          &lt;artifactId&gt;maven-compiler-plugin&lt;/artifactId&gt;
          &lt;version&gt;3.8.1&lt;/version&gt;
          &lt;configuration&gt;
            &lt;source&gt;${}&lt;/source&gt;
            &lt;target&gt;${}&lt;/target&gt;
            &lt;encoding&gt;${}&lt;/encoding&gt;
            &lt;parameters&gt;true&lt;/parameters&gt;
          &lt;/configuration&gt;
        &lt;/plugin&gt;
      &lt;/plugins&gt;
      &lt;resources&gt;
        &lt;resource&gt;
          &lt;directory&gt;src/main/resources&lt;/directory&gt;
          &lt;filtering&gt;true&lt;/filtering&gt;
        &lt;/resource&gt;
        &lt;resource&gt;
          &lt;directory&gt;src/main/java&lt;/directory&gt;
          &lt;includes&gt;
            &lt;include&gt;**/*.xml&lt;/include&gt;
          &lt;/includes&gt;
        &lt;/resource&gt;
      &lt;/resources&gt;
  &lt;/build&gt;
&lt;/project&gt;

In the module directory

&lt;?xml version="1.0" encoding="UTF-8"?&gt;
&lt;project xmlns="/POM/4.0.0"
         xmlns:xsi="http:///2001/XMLSchema-instance"
         xsi:schemaLocation="/POM/4.0.0 /xsd/maven-4.0."&gt;
    &lt;parent&gt;
        &lt;artifactId&gt;demo&lt;/artifactId&gt;
        &lt;groupId&gt;&lt;/groupId&gt;
        &lt;version&gt;1.0.0&lt;/version&gt;
    &lt;/parent&gt;
    &lt;modelVersion&gt;4.0.0&lt;/modelVersion&gt;

    &lt;artifactId&gt;module&lt;/artifactId&gt;

    &lt;description&gt;
        moduleModule
    &lt;/description&gt;

    &lt;dependencies&gt;
		  &lt;!-- SpringBoot Webcontainer --&gt;
        &lt;dependency&gt;
          &lt;groupId&gt;&lt;/groupId&gt;
          &lt;artifactId&gt;spring-boot-starter-web&lt;/artifactId&gt;
          &lt;exclusions&gt;
            &lt;exclusion&gt;
              &lt;groupId&gt;.log4j&lt;/groupId&gt;
            &lt;artifactId&gt;log4j-api&lt;/artifactId&gt;
            &lt;/exclusion&gt;
              &lt;exclusion&gt;
                &lt;groupId&gt;&lt;/groupId&gt;
                &lt;artifactId&gt;spring-boot-starter-tomcat&lt;/artifactId&gt;
              &lt;/exclusion&gt;
          &lt;/exclusions&gt;
      &lt;/dependency&gt;

      &lt;!-- websocket --&gt;
      &lt;dependency&gt;
        &lt;groupId&gt;&lt;/groupId&gt;
        &lt;artifactId&gt;spring-boot-starter-websocket&lt;/artifactId&gt;
        &lt;exclusions&gt;
          &lt;exclusion&gt;
            &lt;groupId&gt;&lt;/groupId&gt;
            &lt;artifactId&gt;spring-boot-starter-tomcat&lt;/artifactId&gt;
          &lt;/exclusion&gt;
        &lt;/exclusions&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
        &lt;groupId&gt;&lt;/groupId&gt;
        &lt;artifactId&gt;tomcat-embed-core&lt;/artifactId&gt;
        &lt;exclusions&gt;
          &lt;exclusion&gt;
            &lt;artifactId&gt;tomcat-annotations-api&lt;/artifactId&gt;
            &lt;groupId&gt;&lt;/groupId&gt;
          &lt;/exclusion&gt;
        &lt;/exclusions&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
        &lt;groupId&gt;&lt;/groupId&gt;
        &lt;artifactId&gt;tomcat-embed-el&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
        &lt;groupId&gt;&lt;/groupId&gt;
        &lt;artifactId&gt;tomcat-embed-websocket&lt;/artifactId&gt;
        &lt;exclusions&gt;
          &lt;exclusion&gt;
            &lt;artifactId&gt;tomcat-annotations-api&lt;/artifactId&gt;
            &lt;groupId&gt;&lt;/groupId&gt;
          &lt;/exclusion&gt;
        &lt;/exclusions&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
        &lt;groupId&gt;&lt;/groupId&gt;
        &lt;artifactId&gt;-api&lt;/artifactId&gt;
      &lt;/dependency&gt;
    &lt;/dependencies&gt;
&lt;/project&gt;

References

  • spring-boot-starter-parent 2.5.14 maven dependencies

This is the end of this article about the solution to SpringBoot Tomcat vulnerability repair. For more related SpringBoot Tomcat vulnerability repair content, please search for my previous articles or continue browsing the related articles below. I hope everyone will support me in the future!