Sploitus

Exploit for Deserialization of Untrusted Data in Apache Tomcat

githubexploit Β· 2025-09-03

Exploit Code

README80 lines
## https://sploitus.com/exploit?id=4A760820-57CE-5D50-8C65-9AA4B39EAAE3
# CVE-2025-24813 – Proof of Concept

![Status](https://img.shields.io/badge/status-PoC-orange)
![CVE](https://img.shields.io/badge/CVE-2025--24813-critical-red)
![License](https://img.shields.io/badge/license-MIT-blue)

## πŸ“– Overview

This repository contains a **Proof of Concept (PoC)** for **CVE-2025-24813**, a vulnerability affecting [affected software/product name here – update based on advisory].  

The PoC demonstrates the issue in a **safe and reproducible way**, to help researchers, defenders, and engineers validate patches across different environments.

> ⚠️ **Disclaimer**  
> This PoC is provided for **educational and research purposes only**.  
> Do not use it against systems without explicit authorization. The author takes no responsibility for any misuse.

---

## 🧩 Vulnerability Details

- **CVE ID**: CVE-2025-24813  
- **Severity**: Critical (CVSS 9.x – update if available)  
- **Impact**: Remote Code Execution / Privilege Escalation / Info Disclosure (adjust depending on actual CVE)
- 
References:
- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2025-24813)  
- [Vendor Advisory](https://security.vendor.com/advisory/CVE-2025-24813)  

---

## βš™οΈ Tested Environments

The PoC was tested against multiple environments to validate reproducibility:

- βœ… Ubuntu 22.04 LTS – Python 3.11  
- βœ… Debian 12 – Dockerized setup  
- βœ… Windows 11 – WSL2 with Ubuntu 20.04  
- βœ… Kali Linux 2025.1
- 
---

## πŸš€ Usage

### 1. Clone the Repository
```bash
git clone https://github.com//CVE-2025-24813-PoC.git
cd CVE-2025-24813-PoC
```

### 2. Install Requirements
```bash
pip install -r requirements.txt
```

### 3. Run the PoC
```bash
python3 poc.py # You will get prompted to enter the target host url
```

---

## πŸ“‚ Repository Structure

```
β”œβ”€β”€ poc.py              # Main PoC script
└── README.md           # Project documentation
```

---

## πŸ›‘οΈ Mitigation

Update to the latest patched version provided by the vendor.  
If immediate patching is not possible:
- Restrict access to vulnerable services.
- Monitor logs for suspicious requests.
- Apply vendor-provided temporary mitigations.

---