CVE-2025-55754

What it actually does

Apache Tomcat failed to neutralize ANSI escape, meta, and control sequences before writing attacker-controlled request data to logs or console output. A remote unauthenticated attacker could send a specially crafted URL containing ANSI control sequences that, when logged and later rendered in an ANSI-capable console, could manipulate terminal display behavior and potentially clipboard contents. The flaw is not a direct server-side code execution primitive by itself; exploitation requires a human operator to view the affected output in a vulnerable console and be deceived into taking an unsafe action. Affected Tomcat versions include 11.0.0-M1 through 11.0.10, 10.1.0-M1 through 10.1.44, 9.0.40 through 9.0.108, and known affected EOL 8.5.60 through 8.5.100.

Why it matters to the business

Successful exploitation could turn routine log review or console monitoring into a social-engineering path to administrative compromise. If an administrator is tricked into executing an attacker-controlled command, the result could include server takeover, data theft, credential exposure, service disruption, or further lateral movement. The risk is highest for Tomcat instances run interactively in consoles that support ANSI escape sequences, especially on Windows, and for teams that routinely inspect live console output. Although this is not listed in CISA KEV and no public exploit maturity is reported, the high CVSS score, remote unauthenticated trigger, and long publication age mean exposed fleets should be upgraded rather than relying on operator caution.

How an attack unfolds

An attacker first identifies a Tomcat service that logs request paths or malformed URLs to console or log output. The attacker sends an HTTP request containing encoded or raw ANSI escape/control sequences in the URL. Vulnerable Tomcat versions write those sequences without escaping them. If Tomcat is running in an interactive ANSI-capable console, or if logs are later opened in a terminal that interprets ANSI sequences, the terminal may process the embedded controls instead of displaying them as harmless text. The attacker’s goal is to alter what the administrator sees, obscure malicious input, modify terminal state, or manipulate clipboard content so that the administrator is tricked into pasting or running an attacker-controlled command. The exploit chain therefore depends on both log injection and administrator interaction; compromise occurs only if the social-engineering step succeeds.

How to fix it

Upgrade Apache Tomcat to a fixed release: 11.0.11 or later, 10.1.45 or later, or 9.0.109 or later. Environments using Tomcat 8.5.x should migrate to a supported fixed branch because 8.5 was end-of-life when this issue was published and 8.5.60 through 8.5.100 are known affected. For source-based deployments, include the Apache Tomcat fix corresponding to commit 312541e51725cdfe98d8cc6414b31d36d913fdd1 or a later upstream revision. As defense in depth, avoid running production Tomcat interactively in administrator consoles, route logs to centralized logging systems that render control characters safely, configure log viewers to show escaped control characters rather than interpreting them, restrict administrative console access, and consider filtering or alerting on HTTP requests containing encoded ESC/control characters such as %1b, %1B, or CSI/OSC sequences. Treat unrelated package mappings in automated feeds, such as Firefox entries, as requiring vendor-advisory validation before actioning them for this Tomcat issue.

How to confirm the fix worked

Confirm deployed Tomcat versions are 11.0.11+, 10.1.45+, or 9.0.109+. For packaged installations, verify the vendor package changelog explicitly includes the Tomcat fix for ANSI escape sequence logging. For source builds, confirm the patched upstream commit or a later equivalent is present. Review startup banners, package manager metadata, container image labels, SBOMs, and application server inventories to identify lingering 11.0.0-M1-11.0.10, 10.1.0-M1-10.1.44, 9.0.40-9.0.108, and EOL 8.5.60-8.5.100 deployments. After patching, perform a controlled test in a non-production environment by sending a benign request containing percent-encoded ESC/CSI characters and verifying that Tomcat logs escape or neutralize the characters rather than allowing terminal interpretation. Also validate that production operational procedures do not require administrators to view untrusted live request logs in ANSI-interpreting consoles.

Typical attack path

1. Identify an internet-facing or reachable Apache Tomcat instance running an affected version.
2. Send crafted HTTP requests with URL paths or parameters containing ANSI escape/control sequences, often percent-encoded to survive transit.
3. Cause Tomcat to log the malicious request to console output, access logs, application logs, or error logs without escaping the control characters.
4. Wait for an administrator or operator to view the affected output in an ANSI-capable terminal or console.
5. Use terminal manipulation or clipboard manipulation effects to mislead the operator into copying, pasting, or executing attacker-controlled content.
6. If the operator executes the attacker-controlled command, gain code execution in that user’s context and attempt credential theft, persistence, or lateral movement.

How to detect it

Look for evidence of crafted requests containing ANSI escape or control sequences in Tomcat access logs, application logs, reverse proxy logs, WAF logs, load balancer logs, and centralized SIEM records. Focus on request paths, query strings, headers, and error messages containing raw ESC characters, percent-encoded ESC values, CSI sequences, or OSC clipboard sequences. Relevant Tomcat log sources commonly include catalina.out, catalina.log, localhost_access_log.*, localhost.*, manager.*, host-manager.*, and application-specific logs. Because exploitation requires administrator interaction, correlate suspicious requests with operator activity: terminal sessions, RDP/SSH sessions, PowerShell Script Block logs, Windows Security process creation events, Sysmon Event ID 1, Linux auditd execve records, shell history files, and EDR telemetry. Look for unusual command execution by administrator accounts shortly after log viewing, especially commands launched from shells or consoles that do not align with normal maintenance. Also review whether log lines appear visually overwritten, blanked, colorized, or otherwise malformed, which may indicate terminal control manipulation. Clipboard manipulation may not be recoverable after the fact, so endpoint process creation and command history are usually more reliable than clipboard artifacts.

• %1b
• %1B
• %1b%5b
• %1B%5B
• %1b[
• %1B[
• \x1b[
• \u001b[
• %1b%5d
• %1B%5D
• %1b]
• %1B]
• \x1b]
• \u001b]
• %1b%5d52%3b
• %1B%5D52%3B
• %1b]52;
• %1B]52;
• \x1b]52;
• \u001b]52;
• %9b
• %C2%9B
• localhost_access_log
• catalina.out
• catalina.log

What your security team should do

• Prioritize upgrade of all supported Apache Tomcat deployments to 11.0.11+, 10.1.45+, or 9.0.109+; migrate Tomcat 8.5 deployments to a supported branch.
• Inventory containers, embedded Tomcat applications, appliance bundles, developer-run services, and source-built Tomcat instances, not only standalone server installations.
• Stop running production Tomcat in interactive administrator consoles where feasible; run it as a service and forward logs to centralized logging platforms that safely escape control characters.
• Create detection logic for HTTP requests and log entries containing ANSI ESC, CSI, or OSC clipboard-control sequences, especially percent-encoded variants.
• Review administrator workstations and jump hosts for suspicious command execution shortly after viewing Tomcat logs or consoles.
• Train operators not to copy commands from terminal output or logs and to treat visually unusual log output as potentially hostile.
• If suspicious ANSI sequence activity is found, preserve Tomcat logs, terminal scrollback if available, shell histories, PowerShell logs, and endpoint process telemetry for incident response.