CVE-2025-55754: Apache Tomcat ANSI Escape Injection Flaw

CVE-2025-55754 Overview

CVE-2025-55754 is a critical improper neutralization of escape, meta, or control sequences vulnerability affecting Apache Tomcat. The vulnerability stems from Tomcat's failure to properly escape ANSI escape sequences in log messages. When Tomcat runs in a console on a Windows operating system that supports ANSI escape sequences, an attacker can craft a malicious URL containing ANSI escape sequences to manipulate the console and clipboard. This manipulation could potentially trick an administrator into executing an attacker-controlled command.

While no direct attack vector was confirmed, researchers noted that this attack may also be possible on other operating systems. The vulnerability affects multiple versions of Apache Tomcat across the 11.x, 10.x, and 9.x branches, as well as end-of-life versions in the 8.5.x branch.

Critical Impact

Attackers can inject ANSI escape sequences via crafted URLs to manipulate administrator consoles and clipboards, potentially leading to arbitrary command execution through social engineering.

Affected Products

• Apache Tomcat 11.0.0-M1 through 11.0.10
• Apache Tomcat 10.1.0-M1 through 10.1.44
• Apache Tomcat 9.0.40 through 9.0.108
• Apache Tomcat 8.5.60 through 8.5.100 (EOL versions)

Discovery Timeline

• 2025-10-27 - CVE-2025-55754 published to NVD
• 2025-11-14 - Last updated in NVD database

Technical Details for CVE-2025-55754

Vulnerability Analysis

This vulnerability is classified under CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences. The core issue lies in Apache Tomcat's logging subsystem, which fails to sanitize ANSI escape sequences before writing them to console output. ANSI escape sequences are special character sequences that terminals interpret as commands rather than displayable text, allowing control over cursor positioning, text colors, and in some cases, clipboard manipulation.

The attack requires user interaction—specifically, an administrator viewing logs in a terminal that supports ANSI escape sequences. The vulnerability has a changed scope, meaning successful exploitation can impact resources beyond the vulnerable component itself, potentially affecting the underlying operating system through clipboard manipulation and command injection.

Root Cause

The root cause is the absence of input sanitization in Tomcat's logging mechanism. When processing HTTP requests, Tomcat logs various request parameters including URLs. If an attacker includes ANSI escape sequences in a URL parameter, these sequences pass through to the log output without being escaped or neutralized. Modern terminals, particularly on Windows systems with ANSI support enabled, interpret these sequences as terminal commands rather than literal text.

Attack Vector

The attack exploits the network-accessible nature of Apache Tomcat web servers. An attacker sends a specially crafted HTTP request containing ANSI escape sequences embedded in the URL or request parameters. When an administrator views the logs in a terminal console:

1. The malicious escape sequences are rendered by the terminal
2. These sequences can manipulate the terminal display, potentially hiding malicious content
3. Advanced escape sequences can inject content into the system clipboard
4. The administrator may unknowingly paste and execute attacker-controlled commands

The attack mechanism involves crafting URLs with embedded escape sequences that, when logged and displayed in a vulnerable terminal, can execute terminal-level commands such as clipboard manipulation. For example, certain terminal emulators support OSC 52 sequences that can write arbitrary content to the system clipboard. An attacker could inject a malicious command into the clipboard, and if the administrator pastes without inspection, the command executes.

For detailed technical information about the escape sequence injection mechanism, refer to the Apache Security Mailing List Thread.

Detection Methods for CVE-2025-55754

Indicators of Compromise

• HTTP requests containing unusual escape character sequences (character code 0x1B or \\x1b) in URLs or parameters
• Log entries with unexpected terminal control sequences such as \\x1b[ or \\x1b]
• Administrator reports of unusual terminal behavior when viewing Tomcat logs
• Clipboard content unexpectedly changing when viewing server logs

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing ANSI escape sequences in URL parameters
• Configure intrusion detection systems (IDS) to alert on HTTP requests with embedded control characters
• Enable detailed request logging at the load balancer or reverse proxy level to identify malicious injection attempts before they reach Tomcat
• Deploy endpoint detection solutions to monitor for unusual terminal manipulation on administrator workstations

Monitoring Recommendations

• Monitor HTTP access logs for requests containing escape sequences or non-printable characters
• Implement log aggregation with pattern matching to identify potential exploitation attempts
• Set up alerts for unusual clipboard access patterns on systems used for server administration
• Review terminal emulator configurations to ensure secure defaults that limit escape sequence capabilities

How to Mitigate CVE-2025-55754

Immediate Actions Required

• Upgrade Apache Tomcat to version 11.0.11 or later, 10.1.45 or later, or 9.0.109 or later
• Avoid viewing Tomcat logs directly in terminals that support ANSI escape sequences until patched
• Configure log viewing tools to strip or escape ANSI sequences before display
• Use a reverse proxy or WAF to filter requests containing suspicious escape sequences

Patch Information

Apache has released patched versions that address this vulnerability. Users should upgrade to the following fixed versions:

• Apache Tomcat 11.0.11 or later for the 11.x branch
• Apache Tomcat 10.1.45 or later for the 10.x branch
• Apache Tomcat 9.0.109 or later for the 9.x branch

Users running EOL versions (8.5.x and earlier) should migrate to a supported version. For detailed patch information, refer to the Apache Security Mailing List Thread.

Workarounds

• Configure terminal emulators to disable ANSI escape sequence processing when viewing untrusted log content
• Use log viewing tools that automatically sanitize escape sequences, such as cat -v or less -R
• Implement a log preprocessing pipeline that strips ANSI sequences before storage or display
• Deploy a reverse proxy with input validation to block requests containing escape characters

# Configuration example - Strip ANSI escape sequences from Tomcat logs before viewing
# Use sed to remove ANSI escape sequences
cat catalina.out | sed 's/\\x1b\[[0-9;]*[a-zA-Z]//g'

# Or use less with raw control character display disabled
less -S catalina.out

# Configure terminal to disable clipboard escape sequences (example for xterm)
# Add to ~/.Xresources:
# XTerm*disallowedWindowOps: 20,21,SetXprop