mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Michael Haag
20cb4400dc
"There's a snake in my Tomcat!" When malicious serialized objects started showing up at Sunnyside Server Farm, Security Sheriff Haag rounded up a posse of new detections to keep the web applications safe. This PR delivers: - Two new best friends: tomcat_session_file_upload_attempt and tomcat_session_deserialization_attempt - A brand new playset: "Apache Tomcat Session Deserialization Attacks" analytic story - No more crying when the bad toys try to upload .session files - The claw of justice comes down when suspicious JSESSIONID cookies appear Remember what Security Ranger Haag always says: "To HTTP response codes and beyond!"
23 lines
2.1 KiB
YAML
23 lines
2.1 KiB
YAML
name: Apache Tomcat Session Deserialization Attacks
|
|
id: 1a0f125a-0f65-44fc-a96f-576d53d69478
|
|
version: 1
|
|
status: production
|
|
date: '2025-03-25'
|
|
author: Michael Haag, Splunk
|
|
description: This analytic story addresses critical vulnerabilities in Apache Tomcat that allow attackers to achieve remote code execution through session deserialization attacks. These attacks exploit path equivalence issues in Tomcat's session handling mechanisms, particularly when configured with writable DefaultServlet and file-based session persistence, enabling attackers to upload and execute malicious serialized objects through manipulated session files.
|
|
narrative: 'Apache Tomcat''s session management functionality can be exploited when specific configurations are present, particularly involving the DefaultServlet and file-based session persistence. Attackers leverage this by first uploading a malicious serialized object disguised as a session file through an HTTP PUT request. Once the file is uploaded, they manipulate the JSESSIONID cookie to reference this malicious file, forcing Tomcat to deserialize the content and potentially execute arbitrary code. The attack typically manifests in two stages: an initial PUT request that successfully creates a .session file, followed by a GET request with a specially crafted JSESSIONID cookie that triggers the deserialization. This technique has been observed in real-world attacks where threat actors exploit vulnerable Tomcat installations to establish persistent access and execute malicious code on the target system. The detections in this story focus on identifying both stages of this attack pattern, allowing defenders to detect and respond to exploitation attempts before they succeed.'
|
|
references:
|
|
- https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2025-24813
|
|
- https://github.com/vulhub/vulhub/tree/master/tomcat/CVE-2025-24813
|
|
- https://www.rapid7.com/db/vulnerabilities/apache-tomcat-cve-2025-24813/
|
|
tags:
|
|
category:
|
|
- Adversary Tactics
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
usecase: Advanced Threat Detection
|
|
cve:
|
|
- CVE-2025-24813 |