Denial of Service Vulnerability in Apache Commons FileUpload and Tomcat Packages
Summary
DEBIAN-CVE-2023-24998: Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Affects libcommons-fileupload-java versions < 1.4-1+deb11u1. Fixed in 1.4-1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Commons FileUpload is a Java library that simplifies the process of handling file uploads in web applications. It provides a robust API for managing file uploads, including multipart requests. The library is widely used in conjunction with Java-based web servers like Apache Tomcat. However, prior to version 1.5, it lacked proper limits on the number of request parts that could be processed, making it susceptible to denial of service (DoS) attacks. This vulnerability can be exploited by attackers to overwhelm the server with excessive uploads, leading to service disruption.
Vulnerability Detail
The vulnerability arises from Apache Commons FileUpload versions before 1.5, which do not impose limits on the number of request parts processed. This oversight allows an attacker to exploit the file upload functionality by sending a malicious upload or a series of uploads, potentially leading to a denial of service. The lack of default configuration for the new limit (FileUploadBase#setFileCountMax) exacerbates the issue, as it requires explicit configuration to mitigate the risk.
How To Fix
Minimum fixed version
1.4-1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libcommons-fileupload-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the number of file uploads by configuring the FileUploadBase#setFileCountMax option in your application. This requires modifying your application code to set the maximum number of file parts that can be processed. For example:
FileUploadBase upload = new FileUploadBase();
upload.setFileCountMax(5); // Limit to 5 file uploads
Conclusion
The vulnerability in Apache Commons FileUpload and Tomcat packages poses a significant risk of denial of service attacks. It is crucial for users to update their packages to the latest patched versions and implement proper configurations to mitigate this risk. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain application security.
See every vulnerability recorded for libcommons-fileupload-java →
FAQ
The vulnerability allows attackers to exploit file upload functionality, potentially leading to a denial of service by overwhelming the server with excessive uploads.
Apache Commons FileUpload versions before 1.5 and specific versions of Tomcat 9 and 10 are vulnerable.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
Update the affected packages to their patched versions as specified in the 'how to fix' section.
Yes, you can configure the FileUploadBase#setFileCountMax option in your application to limit the number of file uploads.
References
Related vulnerabilities
Recent vulnerabilities recorded for libcommons-fileupload-java.
