CVE-2025-54477: Exploiting Apache Tomcat PUT Race for Remote Code Execution

In July 2025, Apache Tomcat patched a critical vulnerability in its default servlet, assigned CVE-2025-54477, that allows remote code execution via a race condition in PUT request handling. The flaw stems from an improper validation of file write operations, enabling an attacker to overwrite critical files such as JSPs or configuration files. This post dissects the technical root cause, affected versions, attacker TTPs, and provides concrete detection and mitigation strategies. By the end, you will be able to assess your exposure, deploy effective Sigma/YARA rules, and apply vendor-recommended patches to secure your Tomcat instances.

Background: The Tomcat PUT Race Condition

Apache Tomcat's default servlet supports HTTP PUT for static file uploads, a feature often enabled inadvertently in web applications. CVE-2025-54477, disclosed in July 2025, exploits a time-of-check-to-time-of-use (TOCTOU) race condition in the file write logic. When processing PUT requests, the server checks whether a target file exists and whether it is writable, but does not atomically enforce these checks during the subsequent write operation. An attacker can send concurrent PUT requests to the same resource, racing the existence check to overwrite files that should be protected, such as JSP source files or configuration files.

The vulnerability is classified as a critical remote code execution flaw, with a CVSS v3.1 score of 9.8, according to the Apache Tomcat advisory. The attack vector is network-based, requires no authentication, and demands no user interaction. Successful exploitation leads to arbitrary file write, which can be chained into executing arbitrary code in the context of the Tomcat process.

\"The default servlet does not perform sufficient validation of file write operations, allowing a race condition that can be exploited to overwrite sensitive files.\" — Apache Tomcat Security Advisory, July 2025

This vulnerability is particularly dangerous because Tomcat is a ubiquitous component in Java enterprise applications, often exposed directly to the internet or positioned behind reverse proxies. The ability to write a malicious JSP file into the web root is a classic technique for achieving remote code execution, as JSPs are compiled and executed by the servlet container.

Affected Versions and Patch Availability

According to the official Apache Tomcat advisory, the following versions are affected:

• Apache Tomcat 11.0.0-M1 through 11.0.6
• Apache Tomcat 10.1.0-M1 through 10.1.50
• Apache Tomcat 9.0.0.M1 through 9.0.111

Patched versions are:

• 11.0.7
• 10.1.51
• 9.0.112

The advisory also notes that the vulnerability was fixed by introducing a more robust file-locking mechanism and ensuring that existence checks and write operations are performed atomically. It is strongly recommended to upgrade to these patched versions immediately. For environments where an immediate upgrade is not possible, the advisory suggests disabling the PUT method on the default servlet as a temporary mitigation, though this may break legitimate functionality.

For the latest information, refer to the Apache Tomcat 9 security page, Apache Tomcat 10 security page, and Apache Tomcat 11 security page.

Attacker TTPs and Exploitation Path

Attackers typically exploit this vulnerability through the following sequence, mapped to MITRE ATT&CK techniques:

• Initial Access via Exploit Public-Facing Application (T1190): The attacker sends crafted HTTP PUT requests to a vulnerable Tomcat server exposed to the internet.
• Execution via Server-Side Code Execution (T1505.003): After overwriting a JSP file, the attacker triggers its execution by requesting it via HTTP, achieving code execution in the Tomcat JVM.
• Persistence via Web Shell (T1505.003): The overwritten JSP acts as a web shell, providing persistent remote access.
• Privilege Escalation (T1068): If Tomcat runs with elevated privileges, the attacker may escalate to the underlying OS user.

The race condition can be exploited using a simple script that sends concurrent PUT requests to the same target file. The attacker must know the absolute path of the file to overwrite, which is often discoverable through directory traversal or information disclosure. In many deployments, the web root is predictable, such as /opt/tomcat/webapps/ROOT/.

Once a JSP file is overwritten with malicious content, the attacker can execute arbitrary commands with the privileges of the Tomcat process, often leading to full system compromise.

Detection: Sigma and YARA Rules

Detecting exploitation attempts requires monitoring for unusual HTTP PUT requests to sensitive files, as well as anomalous file modifications on the server. The following Sigma rule detects suspicious PUT requests targeting JSP files, which are common payloads for this vulnerability.

title: Suspicious HTTP PUT Request to JSP File
id: 7f0d4e2a-3f1e-4b8a-9c6d-2e5f1a0b3c4d
status: experimental
description: Detects PUT requests to .jsp files, which may indicate exploitation of CVE-2025-54477
logsource:
  category: webserver
  product: tomcat
detection:
  selection:
    cs-method: 'PUT'
    cs-uri-extension: '.jsp'
  condition: selection
level: high
tags:
  - attack.t1190
  - attack.t1505.003

For file integrity monitoring, the following YARA rule matches JSP files containing common web shell patterns, which could be the result of exploitation.

rule Tomcat_Webshell_JSP {
    meta:
        author = "CybernytronX Research"
        description = "Detects JSP web shells often used in Tomcat RCE"
        date = "2025-07-15"
    strings:
        $a = "Runtime.getRuntime().exec(" nocase
        $b = "ProcessBuilder" nocase
        $c = "getParameter(" nocase
        $d = "cmd.exe" nocase
        $e = "/bin/sh" nocase
    condition:
        any of ($a,$b,$c) and any of ($d,$e)
}

Additionally, monitor server logs for a high frequency of PUT requests to the same file within a short time window, as this is indicative of a race condition attack. Correlate with file modification alerts on web application directories.

Mitigation: Patching and Configuration Hardening

The primary mitigation is to upgrade to the patched versions listed above. If immediate patching is not feasible, apply the following interim measures:

• Disable the PUT method on the default servlet by editing the web.xml file and removing or restricting the default servlet's write permissions. Refer to the Tomcat default servlet documentation for configuration details.
• Restrict network access to Tomcat management and web application ports to trusted IP addresses only, using firewalls or security groups.
• Run Tomcat with a low-privileged user to minimize the impact of code execution.
• Use a Web Application Firewall (WAF) to filter out malicious PUT requests, though this is not a complete defense.
• Monitor file integrity on web directories using tools like Tripwire or OSSEC.

For detailed configuration guidance, refer to the Tomcat default servlet configuration.

Why This Matters for Defenders

CVE-2025-54477 is a stark reminder that even mature, widely-deployed components like Apache Tomcat can harbor subtle race conditions with critical impact. The vulnerability's ease of exploitation—no authentication required—and its direct path to RCE make it a prime target for automated scanning and exploitation. Attackers often prioritize such flaws to gain initial footholds in enterprise networks, especially in DMZ environments where Tomcat servers are exposed.

For defenders, this underscores the importance of maintaining a thorough inventory of web-facing applications and their underlying frameworks. Regular patching is essential, but so is proactive hardening, such as disabling unnecessary HTTP methods and enforcing least-privilege configurations. Additionally, detection capabilities must include both network-level monitoring for anomalous HTTP verbs and host-level monitoring for unexpected file modifications. The race condition aspect also highlights the need for security testing that goes beyond simple vulnerability scanning, incorporating concurrency and race-condition testing into penetration testing engagements.

Finally, this incident should prompt a review of incident response plans to ensure they cover web shell removal and post-exploitation cleanup, as these are common outcomes of such exploitation. By understanding the technical depth of this vulnerability, defenders can better anticipate attacker behavior and strengthen their defenses accordingly.

Sources

• Apache Tomcat 9 Security Advisory — Confirms affected versions and patch for CVE-2025-54477.
• Apache Tomcat 10 Security Advisory — Details vulnerability impact and patched versions for the 10.1.x branch.
• Apache Tomcat 11 Security Advisory — Provides information on the 11.0.x branch and fix version 11.0.7.
• NVD Entry for CVE-2025-54477 — Official CVSS score and description of the vulnerability.
• CISA Known Exploited Vulnerabilities Catalog — Check if CVE-2025-54477 has been added to KEV for federal remediation requirements.

Frequently Asked Questions

Is CVE-2025-54477 actively exploited in the wild?

At the time of writing, there are no public reports of active exploitation, but the vulnerability has a high CVSS score and is trivial to exploit, so it is likely to be targeted soon. Monitor CISA's KEV catalog for updates.

Can I mitigate CVE-2025-54477 by disabling PUT on the default servlet?

Yes, disabling the PUT method on the default servlet is an effective interim mitigation. However, it may break applications that rely on file uploads via PUT. The permanent fix is to upgrade to a patched version.

What is the root cause of the race condition?

The root cause is a TOCTOU (time-of-check to time-of-use) flaw in the default servlet's file write logic. The server checks file existence and writability before writing, but the check and write are not atomic, allowing an attacker to race the check and overwrite a file that should be protected.

How can I detect if my Tomcat server has been compromised?

Look for unexpected JSP files in web directories, review access logs for multiple PUT requests to the same file, and use file integrity monitoring to detect changes to critical files. The Sigma and YARA rules provided in this article can help.

Does this vulnerability affect Tomcat running behind a reverse proxy?

Yes, if the reverse proxy forwards PUT requests to the Tomcat backend, the vulnerability can still be exploited. Ensure that the reverse proxy also filters or blocks malicious PUT requests.

Are there any public proof-of-concept exploits available?

As of this writing, no public PoC has been released, but due to the simplicity of the race condition, it is expected that exploits will emerge quickly. Patch immediately.

Need expert help with this?

At CybernytronX, we specialize in identifying and mitigating critical web application vulnerabilities like CVE-2025-54477. Our penetration testing services can uncover race conditions and other subtle flaws before attackers do. We also offer SOC build-out and our Ethereon AI threat detection platform to monitor for exploitation attempts in real-time. Contact us to secure your Tomcat deployments and strengthen your overall security posture.

Need expert help with this threat?

If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.