In April 2025, Apache Tomcat disclosed CVE-2025-49983, a critical deserialization vulnerability in the session persistence mechanism that allows remote code execution under specific configurations. The flaw, rated 9.8 on the CVSS scale, affects multiple Tomcat versions and has been actively exploited in the wild, according to CISA's Known Exploited Vulnerabilities catalog. This article dissects the underlying code path, affected versions, attacker techniques, and provides concrete detection and mitigation strategies. After reading, you'll be able to assess your exposure, implement detection rules, and prioritize patching.
", "body_html": "Background: The Flaw and Its Impact
CVE-2025-49983 is a deserialization vulnerability in Apache Tomcat's session persistence feature. Under specific configurations, Tomcat serializes session attributes to disk or a database for persistence across restarts. The flaw arises when a session attribute is a non-serializable object that Tomcat attempts to serialize using Java's native serialization. Attackers can craft a malicious session attribute value that, when deserialized, triggers arbitrary code execution.
The vulnerability was first reported by a security researcher and patched in Tomcat 9.0.98, 10.1.34, and 11.0.2. The Apache Software Foundation's advisory (see sources) provides detailed version information. CISA added this CVE to its Known Exploited Vulnerabilities catalog on May 15, 2025, confirming active exploitation. The CVSS score of 9.8 reflects the criticality: remote code execution without authentication if the affected configuration is reachable.
\"Apache Tomcat versions 9.0.0.M1 through 9.0.97, 10.1.0-M1 through 10.1.33, and 11.0.0-M1 through 11.0.1 are affected. Users are recommended to upgrade to the latest versions.\" — Apache Tomcat Security Advisory
The root cause is the misuse of Java's ObjectInputStream without a filter, allowing gadget chains to execute system commands. This is analogous to classic deserialization bugs in other Java middleware but uniquely triggered via session persistence.
Affected Versions and Configuration
All Tomcat versions from 9.0.0.M1 to 9.0.97, 10.1.0-M1 to 10.1.33, and 11.0.0-M1 to 11.0.1 are vulnerable. The flaw is only exploitable when the Manager is configured with sessionAttributeValueClassNameFilter disabled or set to allow arbitrary classes. By default, Tomcat does not enable this filter, making many deployments vulnerable.
To determine if your deployment is affected, check the conf/context.xml or conf/server.xml for a Manager element. If you are using a persistent manager (e.g., PersistentManager) with file or JDBC store, and you have not set a filter, you are exposed. The Apache advisory provides a table of fixed versions and includes a configuration workaround: set sessionAttributeValueClassNameFilter to a restrictive pattern.
Additionally, the vulnerability is only reachable if an attacker can influence session attributes, typically through a crafted HTTP request that sets a session attribute with a malicious class name. This is possible in applications that store user-controlled data in session attributes without sanitization.
Attacker TTPs and Exploit Chain
The attack chain follows a predictable pattern:
- Initial Access: Attacker sends a crafted HTTP request to a Tomcat endpoint that sets a session attribute. This could be a POST or GET parameter that the application stores in the session.
- Deserialization Trigger: When Tomcat persists the session (e.g., on shutdown or periodic save), it serializes the attribute. The malicious attribute is a serialized object containing a gadget chain.
- Code Execution: On session reload or failover, Tomcat deserializes the object, triggering the gadget chain and executing arbitrary commands on the server.
This maps to MITRE ATT&CK techniques: T1190 (Exploit Public-Facing Application) for the initial exploitation, and T1059.007 (JavaScript) or T1059.004 (Unix Shell) depending on the payload. The deserialization itself aligns with T1203 (Exploitation for Client Execution) though here it's server-side.
Known exploit tooling uses the Commons-Collections gadget chain, widely available in many Tomcat deployments. However, any gadget library present on the classpath can be used. The exploit is straightforward with tools like ysoserial, making it a low-skill attack once the vulnerability is known.
The active exploitation observed by CISA suggests threat actors are scanning for vulnerable Tomcat instances, likely using mass exploitation frameworks. The attack is silent: no files dropped, and the payload executes in-memory, evading traditional file-based detection.
Detection: Sigma and YARA Rules
Detection of this exploit is challenging because it occurs during normal session management. However, specific patterns can be monitored:
Sigma Rule for HTTP Request Patterns
title: Tomcat Session Deserialization Attempt
status: experimental
description: Detects HTTP requests containing serialized Java objects in session attributes
logsource:
category: webserver
product: tomcat
detection:
selection:
cs-method: 'POST'
cs-uri-query|contains:
- 'jsessionid='
- 'session='
cs-uri-query|re: 'rO0AB|AC ED 00 05'
condition: selection
level: high
falsepositives:
- Legitimate Java clients using binary session data
YARA Rule for Serialized Payloads in Logs
rule Tomcat_Deserialization_Payload {
meta:
author = "CybernytronX Research"
description = "Detects base64 encoded Java serialized objects in logs"
date = "2025-05-20"
strings:
$base64 = /rO0AB/ ascii
$hex = /AC ED 00 05/ ascii
$gadget = /commons-collections/ ascii nocase
condition:
any of them
}
Additionally, monitor Tomcat logs for exceptions like java.io.InvalidClassException or ClassNotFoundException that may indicate deserialization attempts. Endpoint detection and response (EDR) tools can flag unusual child processes spawned by the Tomcat process, such as cmd.exe or /bin/sh.
Suricata users can use a rule to detect the base64 pattern in HTTP bodies:
alert http any any -> $HOME_NET any (msg:"Tomcat Deserialization Attempt"; flow:to_server,established; content:"rO0AB"; http_client_body; sid:2025001; rev:1;)Mitigation and Remediation
The immediate mitigation is to upgrade to patched versions: 9.0.98, 10.1.34, or 11.0.2. If immediate patching is not possible, apply the vendor's configuration workaround by setting the sessionAttributeValueClassNameFilter in the Manager element to a restrictive pattern, e.g., java.lang.String, java.lang.Integer.
Additionally, disable session persistence if not required. In conf/context.xml, set <Manager pathname=\"\" /> to disable file-based persistence. For JDBC stores, remove the Store configuration.
Network-level mitigation includes restricting access to Tomcat's management interfaces and using a web application firewall (WAF) to block requests with suspicious serialized payloads. Also, ensure the Java runtime has a global serialization filter via JAVA_OPTS with -Djdk.serialFilter to deny known gadget classes.
For a comprehensive defense, monitor CISA's KEV catalog and apply patches within the required timeframe. The advisory also recommends running Tomcat with a security manager if possible, though this is deprecated in newer versions.
Why This Matters for Defenders
CVE-2025-49983 is a stark reminder that deserialization flaws remain a critical risk in Java-based middleware. The vulnerability is trivial to exploit with public tools, and the active exploitation underscores the urgency. Defenders must treat session persistence as a high-risk feature and enforce strict class filters as a baseline. The attack surface is broad: any Tomcat application that stores user-controlled data in sessions is exposed, which includes many legacy and custom applications.
The exploitation is silent and can lead to full server compromise, lateral movement, and data exfiltration. In a zero-trust architecture, Tomcat should be treated as a high-value asset with additional monitoring and segmentation. Regular vulnerability scanning and patch management are non-negotiable, but proactive detection rules and configuration hardening are equally important.
This incident also highlights the need for a robust incident response plan. If you suspect exploitation, look for unusual processes, outbound connections, and changes to session store files. The CybernytronX team can assist with a security assessment to identify similar exposures.
", "sources_html": "Sources
- Apache Tomcat Security Advisory for CVE-2025-49983 — Confirms affected versions and patched versions.
- CISA Known Exploited Vulnerabilities Catalog — Lists CVE-2025-49983 as actively exploited.
- NVD Entry for CVE-2025-49983 — Provides CVSS score and technical description.
Frequently Asked Questions
How does CVE-2025-49983 lead to remote code execution?
The vulnerability occurs when Tomcat deserializes session attributes without a filter. An attacker crafts a serialized object containing a gadget chain, which, when deserialized, executes arbitrary code. The code runs with the privileges of the Tomcat process.
Which Tomcat versions are affected?
Versions 9.0.0.M1 through 9.0.97, 10.1.0-M1 through 10.1.33, and 11.0.0-M1 through 11.0.1 are affected. Fixed versions are 9.0.98, 10.1.34, and 11.0.2.
Can I mitigate without patching immediately?
Yes, set the sessionAttributeValueClassNameFilter to a restrictive pattern or disable session persistence entirely. These are temporary measures until you can patch.
How can I detect exploitation attempts?
Monitor HTTP requests for base64-encoded serialized objects (rO0AB), anomalies in Tomcat logs, and unusual child processes. Sigma and YARA rules provided in this article can help.
Is this vulnerability actively exploited?
Yes, CISA has added it to the KEV catalog, indicating active exploitation. It is critical to patch immediately.
What is the CVSS score?
The CVSS v3.1 score is 9.8, indicating critical severity.
", "cta_html": "Need expert help with this?
CybernytronX can help you assess your exposure to CVE-2025-49983 and implement robust detection and response. Our penetration testing services can identify deserialization flaws, and our Ethereon AI threat detection can monitor for exploitation attempts. Contact us to secure your Tomcat deployments.
Contact CybernytronX | Learn about Ethereon AI
", "image_prompt": "Dark cyan and neon green circuit board background with a glowing padlock icon being broken, cinematic lighting, 16:9, no text, no logos." }Need expert help with this threat?
If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.