Arbitrary File Overwrite in Apache Commons FileUpload
Summary
CVE-2013-0248: The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecifi... Affects libcommons-fileupload-java versions < 1.3-1. Fixed in 1.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Commons FileUpload is a popular Java library used for uploading files in web applications. It provides a simple API for handling file uploads and is widely used in various frameworks and applications. However, versions 1.0 through 1.2.2 of the library have a vulnerability that allows local users to overwrite arbitrary files on the system.
Vulnerability Detail
The vulnerability (CVE-2013-0248) arises from the default configuration of the javax.servlet.context.tempdir in Apache Commons FileUpload. It uses the /tmp directory for storing uploaded files, which can be exploited by local users to perform symlink attacks and overwrite arbitrary files. By creating a symbolic link to a sensitive file, an attacker can trick the application into overwriting it with an uploaded file, potentially leading to unauthorized access or data loss.
How To Fix
Minimum fixed version
1.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libcommons-fileupload-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately feasible, a possible workaround is to manually configure the temporary directory used by Apache Commons FileUpload. By specifying a secure directory with restricted access permissions, the risk of symlink attacks can be mitigated. Here is an example of how to set the temporary directory to '/var/tmp' in a servlet container configuration file (e.g., web.xml):
<context-param>
<param-name>javax.servlet.context.tempdir</param-name>
<param-value>/var/tmp</param-value>
</context-param>
Note that this workaround may require additional configuration changes depending on the specific deployment environment.
Conclusion
The vulnerability in Apache Commons FileUpload (CVE-2013-0248) allows local users to overwrite arbitrary files on the system through symlink attacks. To mitigate this vulnerability, it is crucial to upgrade to Apache Commons FileUpload version 1.3-1 or later. Alternatively, configuring a secure temporary directory can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libcommons-fileupload-java →
FAQ
The vulnerability allows local users to overwrite arbitrary files on the system, potentially leading to unauthorized access or data loss. However, exploiting this vulnerability requires local access to the target system.
Versions 1.0 through 1.2.2 of Apache Commons FileUpload are affected by this vulnerability.
There are no known public exploits specifically targeting this vulnerability at the time of writing. However, it is always recommended to promptly apply security patches and updates to mitigate the risk.
No, this vulnerability can only be exploited by local users who have access to the target system.
The CVSS score for this vulnerability has not been provided in the available information.
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-fileupload-java.
