Tomcat critical vulnerability, should we worry?

joben

https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq
https://lab.wallarm.com/one-put-request-to-own-tomcat-cve-2025-24813-rce-is-in-the-wild/

Are our AwareIM servers vulnerable to this exploit?

aware_support

It's hard to say whether Aware IM is affected by this vulnerability, but if you are worried, you can download and install Tomcat 9.099 as recommended in the article.
To replace Tomcat in Aware IM, follow these instructions:
1) Install Tomcat in a separate directory
2) Rename AwareIM/Tomcat directory to AwareIM/TomcatOld
3) Copy the installation in 1) into AwareIM/Tomcat folder
4) Copy AwareIM/TomcatOld/webapps/AwareIM into AwareIM/Tomcat/webapps/AwareIM
5) Copy AwareIM/TomcatOld/conf/server.xml to AwareIM/Tomcat/conf/server.xml

joben

Thanks!

I didn't know it would be that easy to upgrade. Always good to have the option.

I have tried to read up on the issue. It seems like file-based sessions has to be activated for this exploit to work. I can't find any signs that this is the case with the AwareIM bundled Tomcat.