Apache Tomcat Partial PUT Session Deserialization Remote Code Execution

CVE-2025-24813 is a path-equivalence vulnerability in the Apache Tomcat DefaultServlet partial PUT implementation that can lead to remote code execution under specific server-side conditions. The vulnerable implementation derives a temporary filename from the attacker-controlled request path by replacing path separators with dots. A crafted partial PUT path can therefore collide with the filename of a persisted session. When Tomcat restores that attacker-controlled session, unsafe Java deserialization can lead to remote command execution. Depending on the server configuration, the same underlying issue can also disclose security-sensitive uploaded files or allow attacker-controlled content to be injected into them; this module exercises the remote-code-execution condition. The module performs the following vulnerability-specific operations: Constructs a fresh version-specific Commons Collections serialized object containing the command to execute. Sends the object in a partial PUT request to a crafted path whose temporary filename collides with the FileStore session filename. Requests the selected session-aware route with the corresponding JSESSIONID, causing PersistentManager and FileStore to restore and deserialize the planted session. Retrieves a randomized command proof before confirming remote code execution and creating the OSCI agent. Successful exploitation creates an OSCI agent with the operating-system privileges of the Tomcat service account.