CVE-2023-24998: Apache Commons FileUpload denial of service via resource exhaustion

CVE-2023-24998 · Severity: high · CVSS 7.5 · Published 2023-02-20

Apache Commons FileUpload is a widely used library for handling file uploads in Java web applications. A vulnerability in this component allows an attacker to crash or slow down a service by sending a specially crafted request with an excessive number of file parts. This can lead to a denial-of-service (DoS) condition, making the affected application unavailable to legitimate users.

Technologies: commons-fileupload:commons-fileupload (Maven), org.apache.tomcat:tomcat-catalina (Maven), org.apache.tomcat:tomcat-coyote (Maven), org.apache.tomcat.embed:tomcat-embed-core (Maven). Vendors: Apache Software Foundation, Maven.

Quick answers

Is CVE-2023-24998 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-24998 being exploited in the wild.
How severe is CVE-2023-24998?
High severity, with a CVSS score of 7.5, published 20 February 2023.
Which products and versions are affected?
Apache Software Foundation Commons FileUpload < 1.5; commons-fileupload:commons-fileupload (Maven) ECOSYSTEM:introduced=0,fixed=1.5; org.apache.tomcat:tomcat-catalina (Maven) ECOSYSTEM:introduced=10.1.0-M1,fixed=10.1.5; org.apache.tomcat:tomcat-coyote (Maven) ECOSYSTEM:introduced=10.1.0-M1,fixed=10.1.5; and 1 more.
Is there a fix for CVE-2023-24998?
Yes. commons-fileupload:commons-fileupload (Maven): upgrade to 1.5 or later; org.apache.tomcat:tomcat-catalina (Maven): upgrade to 10.1.5 or later; org.apache.tomcat:tomcat-coyote (Maven): upgrade to 10.1.5 or later; org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 10.1.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-24998 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2023-24998?
Check whether you run Apache Software Foundation Commons FileUpload, commons-fileupload:commons-fileupload (Maven), org.apache.tomcat:tomcat-catalina (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • commons-fileupload:commons-fileupload (Maven): upgrade to 1.5 or later
    # set commons-fileupload:commons-fileupload to 1.5 in your pom.xml or build.gradle
  • org.apache.tomcat:tomcat-catalina (Maven): upgrade to 10.1.5 or later
    # set org.apache.tomcat:tomcat-catalina to 10.1.5 in your pom.xml or build.gradle
  • org.apache.tomcat:tomcat-coyote (Maven): upgrade to 10.1.5 or later
    # set org.apache.tomcat:tomcat-coyote to 10.1.5 in your pom.xml or build.gradle
  • org.apache.tomcat.embed:tomcat-embed-core (Maven): upgrade to 10.1.5 or later
    # set org.apache.tomcat.embed:tomcat-embed-core to 10.1.5 in your pom.xml or build.gradle

Technical details

The vulnerability is a resource exhaustion issue (CWE-770) in Apache Commons FileUpload. The library fails to impose a limit on the number of request parts (form fields or files) processed in a single multipart request. A remote, unauthenticated attacker can exploit this by sending a request containing a very large number of parts, consuming excessive CPU and memory resources. This issue also affects Apache Tomcat as it bundles the vulnerable library. A fix is available in version 1.5, which introduces the 'FileUploadBase#setFileCountMax' configuration option to limit the number of processed parts.

Affected products

  • Apache Commons FileUpload < 1.5
  • Apache Tomcat 8.5.85 to 8.5.87, 9.0.0-M1 to 9.0.70, 10.1.0-M1 to 10.1.4, 11.0.0-M2 to 11.0.0-M4

Identifiers

  • CVE-2023-24998
  • GHSA-hfrx-6qgj-fp6c

Timeline

  • 2023-02-20: advisory
  • 2023-02-20: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.