Apache-Tomcat-CVE-2025-24813-Lab

CVE-2025-24813: Apache Tomcat Detection & Mitigation Lab A defensive cybersecurity portfolio project demonstrating vulnerability research, detection engineering, log correlation, layered mitigation, and technical documentation in an isolated two-VM environment. Project summary This repository...

CVE-2025-24813-Apache-Tomcat-RCE-PoC

CVE-2025-24813 Apache Tomcat RCE PoC Description Ceci est une preuve de concept PoC pour CVE-2025-24813, une vulnérabilité d'exécution de code à distance RCE dans Apache Tomcat. La vulnérabilité provient de la désérialisation non sécurisée de fichiers de session malveillants téléchargés via des...

CVE-2025-24813-Apache-Tomcat-Partial-PUT-Deserialization-RCE-

CVE-2025-24813 - Apache Tomcat Partial PUT + 역직렬화 RCE 📋 개요 CVE-2025-24813은 Apache Tomcat에서 발견된 높은 심각도 의 취약점으로, 다음 세 가지 조건이 모두 충족될 때 인증되지 않은 원격 코드 실행 을 허용합니다: 1. 기본 서블릿에 쓰기 액세스가 활성화되어 있음 readonly=false. 2. 부분 PUT 지원이 활성화되어 있음 기본값. 3. 파일 기반 세션 지속성이 구성되어 있음 FileStore와 함께 PersistentManager 사용. 공격자는 부...

Tomcat-CVE-2017-12615

Уязвимость произвольной записи файлов в Tomcat через метод PUT CVE-2017-12615 中文版本Chinese version Версия Tomcat: 8.5.19 Настройка окружения docker-compose build docker-compose up -d После успешного выполнения указанных выше команд вы увидите пример страницы Tomcat, перейдя по адресу...

CVE-2026-100849

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl backend/src/Webhook/Connector/AbstractConnector.php, used by the Generic and Discord webhook connectors, rejects only URLs whose host is a litera...

EUVD-2026-87839

AzuraCast is a self-hosted web radio management suite. In AzuraCast before 0.23.8, the station webhook URL validation in AbstractConnector::getValidUrl backend/src/Webhook/Connector/AbstractConnector.php, used by the Generic and Discord webhook connectors, rejects only URLs whose host is a litera...

CVE-2025-24813-POC

JSP Web Shell Uploader Простой инструмент на Python для загрузки базового JSP-веб-шелла на одну или несколько целей через HTTP PUT-запросы. ⚠️ Только для образовательных целей и авторизованного тестирования на проникновение. Apache Tomcat подвержен проблеме Path Equivalence / Path Traversal из-за...

Spring-Boot-Tomcat-CVE-2025-24813

CVE-2025-24813: Apache 1. Explication Tomcat est vulnérable à cause de deux vulnérabilités distinctes, la première est une faiblesse dans DefaultServlet qui permet des écritures partielles pour écrire dans un répertoire temporaire. voir :...

Tomcat-CVE-2025-24813

Условия использования Функция записи DefaultServlet включена: требуется настроить web.xml с параметром inreadonly=false Поддержка частичных PUT-запросов: Tomcat по умолчанию поддерживает блочную загрузку Включить сохранение сессий в файлы: требуется настроить PersistentManager и FileStore в...

CVE-2017-12615

curl -X PUT http://34.124.205.159:8080/1.jsp/ -d @- 1.jsp...

CVE-2026-100626

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

CVE-2026-100627

Capgo Cap-go/capgo.app server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoint, available to "all" and "write" API keys, dispatches to setChannel, which authorizes with checkPermissionc, 'channel.promotebundle', appI...

CVE-2026-100618

Capgo capgo.app is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled icon value, normalizes it, and stores it in public.apps.iconurl without verifying that the image path belongs to the target app's own image namespace e.g...

CVE-2026-100626 capgo through 12.128.2 IDOR via PUT /app icon endpoint

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

CVE-2026-100626

Versions of capgo through 12.128.2 are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the PUT /app/:appId endpoint. The root cause is that the endpoint accepts attacker-controlled icon storage paths . This allows authenticated users to provide arbitrary paths in the pri...

CVE-2026-100626 capgo through 12.128.2 IDOR via PUT /app icon endpoint

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

EUVD-2026-87770

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

CVE-2026-100626 capgo through 12.128.2 IDOR via PUT /app icon endpoint

capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain service-role-signed URLs valid for 7 days t...

EUVD-2026-87721

Capgo Cap-go/capgo.app server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoint, available to "all" and "write" API keys, dispatches to setChannel, which authorizes with checkPermissionc, 'channel.promotebundle', appI...

CVE-2026-100627

The Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. Specifically, the PUT /bundle endpoint (accessible via "all" and "write" API keys) dispatches to setChannel, which fails to include the channel_id during th...