DoS Vulnerability in Apache Commons FileUpload and Tomcat Packages
Summary
CVE-2023-24998: Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Affects libcommons-fileupload-java across 2 version ranges.
< 1.4-1+deb11u1
>= cdfbeaa120cba6a8f1527b91600317ee374450c2, < 1d9a750e5091b6e36aa81c2277200a4b2b5ecd8a
Fixed in 1.4-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Commons FileUpload is a library used for handling file uploads in Java applications. It provides a simple API for processing file uploads from HTTP requests. The library is widely used in various web applications to facilitate file handling. However, prior to version 1.5, it lacked proper limits on the number of request parts it could process, making it susceptible to denial-of-service (DoS) attacks. This vulnerability can be exploited by attackers to overwhelm the server with excessive file uploads, leading to service disruption.
Vulnerability Detail
The vulnerability, identified as CVE-2023-24998, arises from the inability of Apache Commons FileUpload versions before 1.5 to limit the number of request parts processed. An attacker can exploit this flaw by sending a malicious upload or a series of uploads, potentially causing a denial of service. The vulnerability is particularly concerning as it can lead to resource exhaustion on the server, affecting its availability and performance. The issue is not enabled by default, but if the configuration option FileUploadBase#setFileCountMax is not set, the server remains vulnerable.
How To Fix
Minimum fixed version
1.4-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libcommons-fileupload-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to implement a reverse proxy or a web application firewall that can limit the size and number of incoming requests. This can help mitigate the risk of DoS attacks while you work on applying the necessary updates.
Conclusion
CVE-2023-24998 poses a significant risk to applications using Apache Commons FileUpload and Tomcat packages. It is crucial to upgrade to the latest versions and configure the file upload limits to prevent potential denial-of-service attacks. Regular monitoring using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for libcommons-fileupload-java →
FAQ
CVE-2023-24998 is a vulnerability in Apache Commons FileUpload and Tomcat packages that allows attackers to trigger denial-of-service (DoS) conditions by exploiting the lack of limits on the number of request parts processed.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By simply uploading your manifest file, such as package-lock.json, you can check if your application is affected by CVE-2023-24998.
Exploitation of this vulnerability can lead to resource exhaustion on the server, resulting in service disruption and unavailability for legitimate users.
No, the configuration option FileUploadBase#setFileCountMax is not enabled by default. It must be explicitly configured to limit the number of file parts processed.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-fileupload-java.
