CVE-2025-55754
📋 TL;DR
Apache Tomcat fails to escape ANSI escape sequences in log messages, allowing attackers to inject malicious sequences when Tomcat runs in a console supporting ANSI escape sequences (primarily Windows). This could manipulate the console/clipboard to trick administrators into executing attacker-controlled commands. Affects Tomcat versions 11.0.0-M1 through 11.0.10, 10.1.0-M1 through 10.1.44, 9.0.40 through 9.0.108, and some EOL versions.
💻 Affected Systems
- Apache Tomcat
📦 What is this software?
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
Tomcat by Apache
⚠️ Risk & Real-World Impact
Worst Case
Administrator executes malicious command via clipboard manipulation or console spoofing, leading to full system compromise.
Likely Case
Limited impact due to specific console requirements and lack of proven attack vector; primarily a defense-in-depth issue.
If Mitigated
No impact if Tomcat runs without console access or on systems without ANSI escape sequence support.
🎯 Exploit Status
No proven attack vector exists; exploitation requires specific console conditions and social engineering.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.0.11+, 10.1.45+, 9.0.109+
Vendor Advisory: https://lists.apache.org/thread/j7w54hqbkfcn0xb9xy0wnx8w5nymcbqd
Restart Required: Yes
Instructions:
1. Download patched Tomcat version from Apache website. 2. Stop Tomcat service. 3. Backup configuration files. 4. Replace Tomcat installation with patched version. 5. Restore configuration files. 6. Restart Tomcat service.
🔧 Temporary Workarounds
Disable console ANSI support
allConfigure console/terminal to disable ANSI escape sequence interpretation
Windows: Set registry key HKCU\Console\VirtualTerminalLevel to 0
Linux: Set TERM=dumb or use 'stty -echoctl'
Redirect logs away from console
allConfigure Tomcat to log to files only, not console output
Edit logging.properties: set handlers = java.util.logging.FileHandler
Configure log4j/logback to file appenders only
🧯 If You Can't Patch
- Run Tomcat as service without console access (Windows service/Linux systemd)
- Implement strict access controls to Tomcat console/logs
🔍 How to Verify
Check if Vulnerable:
Check Tomcat version with 'catalina.sh version' or examine server startup logs for version stringCheck Version:
Linux: ./catalina.sh version | grep 'Server version'; Windows: catalina.bat version | findstr 'Server version'Verify Fix Applied:
Confirm version is 11.0.11+, 10.1.45+, or 9.0.109+ using version check command📡 Detection & Monitoring
Log Indicators:
- Unusual ANSI escape sequences in Tomcat logs (patterns starting with ESC[)
- Suspicious URLs containing escape character sequences
Network Indicators:
- No network-based indicators as this is a local console vulnerability
SIEM Query:
source="tomcat.logs" AND message MATCHES "\\x1b\\[[0-9;]*[a-zA-Z]"