Tomcat critical vulnerability, should we worry?

joben

https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq
https://lab.wallarm.com/one-put-request-to-own-tomcat-cve-2025-24813-rce-is-in-the-wild/

Are our AwareIM servers vulnerable to this exploit?

aware_support3

joben Are our AwareIM servers vulnerable to this exploit?

Not if you are using Version 10. This ships with Tomcat 11.0.6

aware_support

It's hard to say whether Aware IM is affected by this vulnerability, but if you are worried, you can download and install Tomcat 9.099 as recommended in the article.
To replace Tomcat in Aware IM, follow these instructions:
1) Install Tomcat in a separate directory
2) Rename AwareIM/Tomcat directory to AwareIM/TomcatOld
3) Copy the installation in 1) into AwareIM/Tomcat folder
4) Copy AwareIM/TomcatOld/webapps/AwareIM into AwareIM/Tomcat/webapps/AwareIM
5) Copy AwareIM/TomcatOld/conf/server.xml to AwareIM/Tomcat/conf/server.xml

joben

Thanks!

I didn't know it would be that easy to upgrade. Always good to have the option.

I have tried to read up on the issue. It seems like file-based sessions has to be activated for this exploit to work. I can't find any signs that this is the case with the AwareIM bundled Tomcat.

nhofkes

aware_support3 Not if you are using Version 10. This ships with Tomcat 11.0.6

Not in my case. Yesterday I installed the latest build, 3530, but it seems that this does not ship with Tomcat 11 but Tomcat 10. This is the output when I run C:\AwareIM\Tomcat\bin\version.bat:

Using CATALINA_BASE: “C:\AwareIM\Tomcat”
Using CATALINA_HOME: “C:\AwareIM\Tomcat”
Using CATALINA_TMPDIR: “C:\AwareIM\Tomcat\temp”
Using JRE_HOME: “C:\AwareIM\JDK”
Using CLASSPATH: “C:\AwareIM\Tomcat\bin\bootstrap.jar;C:\AwareIM\Tomcat\bin\tomcat-juli.jar”
Using CATALINA_OPTS: ""
Server version: Apache Tomcat/10.1.18
Server built: Jan 5 2024 14:39:40 UTC
Server number: 10.1.18.0
OS Name: Windows Server 2016
OS Version: 10.0
Architecture: amd64
JVM Version: 21.0.6+8-LTS-188
JVM Vendor: Oracle Corporation

joben

As much as I would like to be up-to-date with all applications, right now I do not consider it to be realistic.
Whenever we have upgraded before, we have had to go through the applications in the testing environment to see what breaks and then fix it. Then we have the themes being replaced or changed so that we have to redesign things.
Sometimes we notice the errors after a few weeks, and this causes a lot of problems if lets say a calculation goes crazy.

Right now I don’t even know how to get to V10 if we don’t have a trial version option anymore so that we can test the applications without purchasing an extra license. I also question the decision to make new versions available so quickly without providing security updates to like the last 2 major versions. This is the biggest issue I am having with AwareIM right now. Advice on how we can decrease the upgrade friction are welcome.

Jaymer

joben i’m planning to have a second window server, and install aware V 10, full license, and import my app and do the testing there. There’s gonna be lots of screens to change and conform to the new CSS from version eight.
Then I will use the online server activation stuff to turn that one off, after I have put aware 10 on my production server, and then I will activate the license on the live server.
I figure I can start on Friday night and get all that done before Monday morning.

You could always spin up a temporary server somewhere, some places, even for free for a short time, and register that device with your new V 10 license code.

I agree it’s a bummer that we can’t get a trial working with unlimited tables.
I don’t fully understand that, since it’s got to be authenticated, it could certainly expire.