CVE-2025-24813 Rule

2025-03-12 21:58:44 +08:00 · 2025-03-12 21:58:44 +08:00 · 393262d525
parent 79cbbb1ad8
commit 393262d525
1 changed files with 13 additions and 0 deletions
--- a/src/rules/cve-2025-24813.lua
+++ b/src/rules/cve-2025-24813.lua
@ -0,0 +1,13 @@
+--[[
+Rule name: CVE-2025-24813 Tomcat RCE
+Filtering stage: Request phase
+Threat level: Critical
+Rule description: Filter the Tomcat remote code execution vulnerability (CVE-2025-24813)
+--]]
+
+
+if waf.method == "PUT" and waf.endWith(waf.uri, "/session") and waf.reqHeaders["Content-Range"] then
+    return true, waf.form["RAW"], true
+end
+
+return false