Vulnerability Directory | CVE-2024-47554 |

Overview

Apache Commons IO is a library of utilities to assist with developing IO functionality. The library contains utility classes, stream implementations, file filters, file comparators, endian transformation classes, and much more. It is widely used across the Java ecosystem to simplify common input/output operations.

‍

A Denial of Service (DoS) vulnerability (CVE-2024-47554) has been identified in Apache Commons IO's XmlStreamReader class. This vulnerability allows attackers to excessively consume CPU resources when processing maliciously crafted XML input, potentially rendering the application unresponsive.

‍

According to OWASP, a Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. If a service receives specially crafted input that exploits resource consumption flaws, it may cease to be available to legitimate users.

‍

This issue affects multiple versions of Apache Commons IO.

‍

Details

Module Info

Product: Apache Commons IO
Affected packages: commons-io
Affected versions: >=2.0 <2.14.0
GitHub repository: https://github.com/apache/commons-io
Published packages: https://central.sonatype.com/artifact/commons-io/commons-io
Package manager: Maven
Fixed in: NES for Apache Commons IO 2.11.x

‍

Vulnerability Info

The security flaw exists in the org.apache.commons.io.input.XmlStreamReader class within Apache Commons IO. When this class processes XML input, it performs character encoding detection. With maliciously crafted input, the encoding detection logic can be exploited to cause excessive CPU consumption.

‍

An application is vulnerable if:

It uses Apache Commons IO versions from 2.0 before 2.14.0
The application processes XML input from untrusted sources using the XmlStreamReader class
The XML input can be controlled or influenced by users external to the application/system.

‍

Mitigation

Only recent versions of Apache Commons IO are community-supported. Only the recent community supported version will receive updates to address this issue. For more information, see here.

‍

Users of the affected components should apply one of the following mitigations:

Upgrade affected versions to supported versions of Apache Commons IO (2.14.0 or later)
Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍