Root-Cause & Secure-Configuration: CVE-2025-24813
Fix CVE-2025-24813 at the deployment. Understand the partial-PUT path-equivalence parsing flaw (CWE-44) and how FileStore session deserialization (CWE-502) turns it into RCE, reject a .jsp extension blacklist, deploy a hardened config (read-only Default Servlet, partial PUT disabled, no FileStore) alongside the upgrade, and verify with audit and vulnscan.
Skills you will practice
- Secure configuration
- safe deserialization; RCE via upload/deserialization
- root cause and remediation; Secure server architecture and hardening
Certifications this lab maps to
This lab builds hands-on skills that appear on these certification exams. thinQtank Learning runs instructor-led training camps for each — click one to see upcoming classes.
The scenario
Triage upgraded Tomcat; IR handled the breach. You are the security engineer who has to harden the deployment so this class cannot form again. Start at the config.
What you will do
- Understand the root cause4 steps
Open the review · Read the root-cause note · Read the current config · What is the root enabler?
- Audit and reject the weak fix4 steps
Audit the current config · Read the proposed change · Audit the weak change · Why is the blacklist insufficient?
- Apply the hardened config8 steps
Read the correct config · Audit the correct config · What makes it safe? · Deploy the config · …
- Reason and document4 steps
Verify the deployed config · Two layers · Write the PR note · The principle
How this lab works
A real Linux-style console. Commands run against real files, so hashes, hex dumps and comparisons give real results.
A file browser where you can place evidence into the lab, either the file provided or one of your own.
Reset a single step, a whole task or the entire lab. The environment is rebuilt so you can try again cleanly.
Progress saves after every step. Close the tab and come back later; your files and answers are waiting.