CVE-2025-49125: Apache Tomcat Auth Bypass Vulnerability

CVE-2025-49125 Overview

Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.

Critical Impact

This vulnerability allows unauthorized access to potentially sensitive resources by bypassing security constraints using alternate paths in specific configurations.

Affected Products

• Apache Tomcat 11.0.0-M1 through 11.0.7
• Apache Tomcat 10.1.0-M1 through 10.1.41
• Apache Tomcat 9.0.0.M1 through 9.0.105

Discovery Timeline

• 2025-06-16 - CVE CVE-2025-49125 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-49125

Vulnerability Analysis

This vulnerability arises when PreResources or PostResources configurations are not mounted at the root level of the web application, allowing alternate paths to access resources without being subject to predefined security constraints. This configuration error facilitates authentication bypass.

Root Cause

The root cause of this vulnerability is improper security attribute enforcement on non-root mounted resources, which fails to apply the same security constraints across all accessible paths.

Attack Vector

This vulnerability can be exploited remotely over the network by an attacker who can craft HTTP requests targeting these alternate resource paths.

// Example exploitation code (sanitized)
import java.net.HttpURLConnection;
import java.net.URL;

public class Exploit {
    public static void main(String[] args) throws Exception {
        URL url = new URL("http://example.com/alternate/path/resource");
        HttpURLConnection conn = (HttpURLConnection) url.openConnection();
        conn.setRequestMethod("GET");
        int responseCode = conn.getResponseCode();
        System.out.println("Response Code : " + responseCode);
    }
}

Detection Methods for CVE-2025-49125

Indicators of Compromise

• Unusual access logs indicating resource access through alternate paths
• Authorization bypass events logged in application logs
• Unexpected HTTP 200 responses for restricted resources

Detection Strategies

Utilize log analysis tools to monitor access logs for attempts to access PreResources or PostResources using unconventional paths. Implement rule-based alerts for these access attempts.

Monitoring Recommendations

Configure application layer monitoring to track HTTP requests and compare against known secure paths. Use Intrusion Detection Systems (IDS) to detect and flag suspicious path access.

How to Mitigate CVE-2025-49125

Immediate Actions Required

• Assess and reconfigure all PreResources and PostResources to be mounted at the root level if security constraints aren't applied
• Conduct a thorough review of security policies to ensure path protection is uniform
• Deploy additional security mechanisms such as Web Application Firewalls (WAF)

Patch Information

Upgrade to Apache Tomcat versions 11.0.8, 10.1.42, or 9.0.106 where this issue is resolved.

Workarounds

Implement URL filtering rules to strictly enforce authentication on all access attempts, regardless of path layout. Ensure that access logs are reviewed regularly to identify and respond to anomalous path access.

# Configuration example
<Location "/secured">
    Require all granted
</Location>
<LocationMatch "/alternate/path">
    Require ip 192.168.1.0/24
</LocationMatch>