Executive brief
Apache Commons FileUpload is a widely used library for handling file uploads in Java web applications. A vulnerability in this component allows an attacker to crash or slow down a service by sending a specially crafted request with an excessive number of file parts. This can lead to a denial-of-service (DoS) condition, making the affected application unavailable to legitimate users.
Technical details
The vulnerability is a resource exhaustion issue (CWE-770) in Apache Commons FileUpload. The library fails to impose a limit on the number of request parts (form fields or files) processed in a single multipart request. A remote, unauthenticated attacker can exploit this by sending a request containing a very large number of parts, consuming excessive CPU and memory resources. This issue also affects Apache Tomcat as it bundles the vulnerable library. A fix is available in version 1.5, which introduces the 'FileUploadBase#setFileCountMax' configuration option to limit the number of processed parts.
Affected products
- Apache Commons FileUpload < 1.5
- Apache Tomcat 8.5.85 to 8.5.87, 9.0.0-M1 to 9.0.70, 10.1.0-M1 to 10.1.4, 11.0.0-M2 to 11.0.0-M4
Timeline
- 2023-02-20: advisory
- 2023-02-20: disclosed