Phan Hoang Nam namhikelo

Apache Tomcat Rewrite Valve Relative Path Traversal (GHSA-wmwf-9ccg-fff5 / CVE-2025-55752)

Date: 2025-10-28

1. Executive Summary

We reproduced the relative path traversal vulnerability affecting Apache Tomcat versions 8.5.6–8.5.100, 9.0.0.M11–9.0.108, 10.1.0-M1–10.1.44, and 11.0.0-M1–11.0.10. The issue arises when RewriteValve rules incorporate user-controlled query parameters into rewritten URLs. Tomcat normalises the rewritten URI before decoding it, permitting encoded ../ sequences to slip past security constraints. During our assessment we:

Deployed a vulnerable Tomcat 9.0.108 instance with a rewrite rule representative of the affected applications.
Confirmed that an encoded traversal payload (path=%2FWEB-INF%2Fweb.xml) retrieves protected resources (HTTP 200) that should be inaccessible.

VMware ESXi 16/VCSA 8

Added in 2022

ESXi 16

4F40H-4ML1K-M89U0-0C2N4-1AKL4

VCSA

0F41K-0MJ4H-M88U1-0C3N0-0A214

2023 Keys

ESXi 8

VYLWZ-ZHZPX-D1WAT-FAJTN-YLQ9X

MySQL 5.7 installation in CentOS 7

sudo su

# Remove MariaDB packages
yum list installed | grep -i maria
yum remove mariadb.x86_64
yum remove mariadb-libs.x86_64

# Download MySQL 5.7 RPM tar

Docker with SSL and an nginx reverse proxy

Running your ASP.NET Core (or other) application in Docker using SSL should not be an overwhelming task. These steps should do the trick.

Run the following steps from a Linux terminal (I used WSL or WSL2 on Windows from the Windows Terminal).

1. Create a `conf` file with information about the cert you'll be creating

It should look something like the content below; call it my-site.conf or something like that.

	QUESTION 1
	Which SysV init configuration file should be modified to disable the ctrl-alt-delete key combination?
	A. /etc/keys
	B. /proc/keys
	C. /etc/inittab
	D. /proc/inittab
	E. /etc/reboot

	QUESTION 2
	Which of the following information is stored within the BIOS? (Choose TWO correct answers.)

	worker_processes 4;

	events {

	worker_connections 1024;
	}

	http {

	# Configuration containing list of application servers

	# ROOT
	if [ "$EUID" -ne 0 ]; then
	echo "RUN AS ROOT ^^!"
	exit 1
	fi

	# Update
	sudo apt update

	# Pakage requirement