Symlink Attack Vulnerability in Apache Commons FileUpload - libcommons-fileupload-java
Summary
DEBIAN-CVE-2013-0248: The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecifi... Affects libcommons-fileupload-java versions < 1.3-1. Fixed in 1.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libcommons-fileupload-java is a Java library that provides support for handling file uploads in web applications. It is widely used in conjunction with Java Servlet technology to facilitate the uploading of files from clients to servers. The library's functionality includes managing file uploads, providing file size limits, and handling multipart requests. However, earlier versions of this library, specifically from 1.0 to 1.2.2, have a critical vulnerability that exposes applications to potential file overwrite attacks due to improper handling of temporary file storage.
Vulnerability Detail
The vulnerability arises from the default configuration of the javax.servlet.context.tempdir in Apache Commons FileUpload versions 1.0 through 1.2.2, which uses the /tmp directory for storing uploaded files. This configuration allows local users to exploit a symlink attack, where they can create symbolic links to arbitrary files in the system. When the file upload occurs, the library may inadvertently overwrite these files, leading to data loss or corruption, and potentially allowing unauthorized access to sensitive information.
How To Fix
Minimum fixed version
1.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libcommons-fileupload-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can change the configuration to use a different directory for storing uploaded files that is not accessible to local users. This can be done by setting the javax.servlet.context.tempdir to a secure directory in your web application's configuration.
Conclusion
The vulnerability in libcommons-fileupload-java poses a significant risk due to its potential for exploitation through symlink attacks. It is crucial for developers to update to the latest version to mitigate this risk and ensure the security of their applications. Additionally, utilizing tools like Vulert can help maintain ongoing vigilance against such vulnerabilities.
See every vulnerability recorded for libcommons-fileupload-java →
FAQ
A symlink attack occurs when an attacker creates a symbolic link to a sensitive file, tricking a program into overwriting that file instead of the intended target.
Versions 1.0 through 1.2.2 of libcommons-fileupload-java are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If left unaddressed, this vulnerability can lead to unauthorized file access, data loss, and potential system compromise.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-fileupload-java.
