CVE-2023-24998

Overview

Apache Struts is a popular open-source web application framework for developing Java EE web applications. It provides robust support for creating modern Java-based enterprise applications.

A Denial of Service (DoS) vulnerability (CVE-2023-24998) has been identified in the Apache Commons FileUpload component used by Apache Struts 1 to process file uploads, which allows attackers to exhaust server resources by submitting a crafted multipart/form-data request that contains a very large number of parts. Because the parser places no limit on the number of parts it will process, a single malicious upload, or a series of uploads, can render the application unresponsive to legitimate users.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. If a service receives a very large number of requests, it may cease to be available to legitimate users. In the same way, a service may stop if a programming vulnerability is exploited, or the way the service handles resources it uses.

This issue affects multiple versions of Apache Struts 1 that perform file-upload handling without a limit on the number of request parts, including every line that bundles or relies on Apache Commons FileUpload prior to 1.5.

Details

Module Info

• Product: Apache Struts 1
• Affected packages: commons-fileupload, struts, struts-core
• Affected versions:
  • Apache Struts 1: >=1.0.0 <=1.3.10
  • Apache Commons FileUpload: <1.5
• GitHub repository: https://github.com/apache/struts1
• Published packages:
  • https://central.sonatype.com/artifact/commons-fileupload/commons-fileupload
  • https://central.sonatype.com/artifact/struts/struts
  • https://central.sonatype.com/artifact/org.apache.struts/struts-core
• Package manager: Maven
• Fixed in: NES for Apache Struts 1.0.2-struts-1.0.4, 1.1.0-struts-1.1.1, 1.2.9-struts-1.2.10 and 1.3.10-struts-1.3.12

Vulnerability Info

This High-severity vulnerability is found in the file-upload handling of Apache Struts 1, which relies on Apache Commons FileUpload to parse multipart/form-data requests.

When a client submits a multipart request, the parser iterates over every part in the request body and allocates memory and temporary storage for each one. Versions of Apache Commons FileUpload prior to 1.5 enforce no upper bound on the number of parts a single request may contain. An attacker can therefore craft a request, or a series of requests, containing an extremely large number of parts, forcing the server to allocate resources for every part until memory and processing capacity are exhausted and the application stops responding to legitimate users. No authentication is required, and the request only needs to reach an endpoint that accepts multipart file uploads. The severity is driven by availability impact alone; the amplification comes from the number of parts, not the size of any individual upload. Apache Commons FileUpload 1.5 addresses the flaw by introducing a configurable cap on the number of parts a multipart request may contain. The cap is opt-in: it is not enabled by default and takes effect once a finite value is configured.

Mitigation

Apache Struts 1 reached End-of-Life in 2013 and is no longer community-supported. The affected line will not receive public updates from the community to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a supported version of Struts 2.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

The file-count limit added by the fix is not enabled by default: set fileCountMax on the <controller> element of struts-config.xml (on 1.0.x, as the fileCountMax init-param of the ActionServlet in web.xml) to a finite value appropriate for the application.