CVE-2025-49124: Apache Tomcat Untrusted Search Path Flaw

CVE-2025-49124 Overview

CVE-2025-49124 is an Untrusted Search Path vulnerability affecting the Apache Tomcat installer for Windows. During the installation process, the Tomcat installer invokes icacls.exe without specifying a full path, creating an opportunity for attackers to hijack the executable search order and execute malicious code with elevated privileges.

Critical Impact

Local attackers can exploit the unqualified path to icacls.exe during Tomcat installation to achieve arbitrary code execution with the privileges of the installer process, potentially leading to complete system compromise.

Affected Products

• Apache Tomcat 11.0.0-M1 through 11.0.7
• Apache Tomcat 10.1.0 through 10.1.41
• Apache Tomcat 9.0.23 through 9.0.105
• Apache Tomcat 8.5.0 through 8.5.100 (EOL)
• Apache Tomcat 7.0.95 through 7.0.109 (EOL)

Discovery Timeline

• 2025-06-16 - CVE-2025-49124 published to NVD
• 2025-10-29 - Last updated in NVD database

Technical Details for CVE-2025-49124

Vulnerability Analysis

This vulnerability is classified as CWE-426 (Untrusted Search Path), a category of vulnerabilities where an application searches for critical resources using an externally-supplied search path that is not adequately restricted. In the context of the Apache Tomcat Windows installer, the installation script calls the Windows utility icacls.exe to configure file permissions but fails to specify the complete filesystem path to the executable.

When Windows executes a program without a full path, it follows a predefined search order that typically begins with the current working directory before checking system directories. An attacker who can place a malicious executable named icacls.exe in a directory that appears earlier in the search path can hijack this execution flow.

Root Cause

The root cause of CVE-2025-49124 lies in the installer script's use of an unqualified executable name when invoking system utilities. Instead of calling C:\Windows\System32\icacls.exe with the full path, the installer simply invokes icacls.exe, relying on the Windows PATH environment variable to locate the executable. This design decision, while convenient, introduces a search path vulnerability that can be exploited in environments where an attacker has write access to directories in the search path.

Attack Vector

The attack vector for this vulnerability requires local access to the target system. An attacker must be able to place a malicious executable in a directory that is searched before the legitimate Windows system directory. Common exploitation scenarios include:

1. Writable PATH directories: If any directory in the PATH environment variable is writable by unprivileged users, an attacker can plant a malicious icacls.exe there
2. Current working directory attacks: If the installer is executed from a directory where the attacker has placed a malicious executable
3. DLL planting in user-accessible locations: Targeting directories commonly accessible during installation workflows

When the legitimate Tomcat installer runs and attempts to call icacls.exe, the malicious executable is executed instead, inheriting the privileges of the installer process—often running with administrative rights during software installation.

Detection Methods for CVE-2025-49124

Indicators of Compromise

• Presence of unexpected icacls.exe files outside of C:\Windows\System32\ or C:\Windows\SysWOW64\
• Process execution logs showing icacls.exe spawned from unusual parent directories
• Newly created executables in directories within the system PATH with names matching Windows system utilities
• Anomalous process behavior during Apache Tomcat installation sequences

Detection Strategies

• Monitor file creation events for executables named icacls.exe in non-standard locations using endpoint detection tools
• Implement application whitelisting to prevent execution of system utilities from unauthorized paths
• Configure Windows Defender Application Control (WDAC) policies to restrict executable locations
• Use SentinelOne's behavioral AI to detect process injection and privilege escalation attempts during software installation

Monitoring Recommendations

• Enable detailed process creation auditing (Windows Event ID 4688) with command line logging
• Monitor for process execution where the image path does not match expected system locations
• Implement file integrity monitoring on critical system directories and PATH locations
• Review installation logs for signs of unexpected executable invocations

How to Mitigate CVE-2025-49124

Immediate Actions Required

• Upgrade Apache Tomcat to version 11.0.8, 10.1.42, or 9.0.106 which contain the fix
• Audit existing Tomcat installations to verify they were not compromised during initial setup
• Review file permissions on directories in the system PATH to ensure they are not world-writable
• Consider reinstalling affected Tomcat versions using the patched installer on sensitive systems

Patch Information

Apache has released fixed versions that address this vulnerability by specifying the full path to icacls.exe in the installer script. Users are strongly recommended to upgrade to the following patched versions:

• Apache Tomcat 11.0.8 (for 11.x users)
• Apache Tomcat 10.1.42 (for 10.1.x users)
• Apache Tomcat 9.0.106 (for 9.0.x users)

For detailed patch information, refer to the Apache Security Mailing List Post and the Openwall OSS Security Update.

Note: Versions 8.5.x and 7.0.x are End-of-Life and will not receive patches. Organizations running these versions should migrate to a supported release immediately.

Workarounds

• Ensure all directories in the system PATH have restrictive write permissions before running the installer
• Run the Tomcat installer from a clean, controlled directory where no untrusted files exist
• Temporarily remove writable directories from the PATH environment variable during installation
• Verify the hash of the installer package against Apache's published checksums before execution
• Use a dedicated, isolated administrative account for software installations

# Verify PATH directories have secure permissions before installation
icacls "C:\Program Files" /verify
icacls "C:\Windows\System32" /verify

# Check for suspicious icacls.exe files outside system directories
where /r C:\ icacls.exe