Junglewise Threat Intelligence

CVE-2023-24998: Apache Commons FileUpload denial of service via resource exhaustion

CVE-2023-24998 · Severity: high · CVSS 7.5 · Published 2023-02-20

Technologies: Apache Tomcat. Vendors: Apache Software Foundation, Apache.

Executive brief

Apache Commons FileUpload is a widely used library for handling file uploads in Java web applications. A vulnerability in this component allows an attacker to crash or slow down a service by sending a specially crafted request with an excessive number of file parts. This can lead to a denial-of-service (DoS) condition, making the affected application unavailable to legitimate users.

Technical details

The vulnerability is a resource exhaustion issue (CWE-770) in Apache Commons FileUpload. The library fails to impose a limit on the number of request parts (form fields or files) processed in a single multipart request. A remote, unauthenticated attacker can exploit this by sending a request containing a very large number of parts, consuming excessive CPU and memory resources. This issue also affects Apache Tomcat as it bundles the vulnerable library. A fix is available in version 1.5, which introduces the 'FileUploadBase#setFileCountMax' configuration option to limit the number of processed parts.

Affected products

  • Apache Commons FileUpload < 1.5
  • Apache Tomcat 8.5.85 to 8.5.87, 9.0.0-M1 to 9.0.70, 10.1.0-M1 to 10.1.4, 11.0.0-M2 to 11.0.0-M4

Timeline

  • 2023-02-20: advisory
  • 2023-02-20: disclosed

References