Apache Struts up to 2.5.31/6.1.2.1/6.3.0 File Upload resource consumption

Summaryinfo

A vulnerability classified as problematic was found in Apache Struts up to 2.5.31/6.1.2.1/6.3.0. This vulnerability affects unknown code of the component File Upload Handler. Such manipulation leads to resource consumption. This vulnerability is uniquely identified as CVE-2023-41835. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Apache Struts up to 2.5.31/6.1.2.1/6.3.0 (Programming Tool Software) and classified as problematic. Affected by this issue is an unknown function of the component File Upload Handler. The manipulation with an unknown input leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. CVE summarizes:

When a Multipart request is performed but some of the fields exceed the maxStringLength  limit, the upload files will remain in struts.multipart.saveDir  even if the request has been denied. Users are recommended to upgrade to versions Struts 2.5.32 or 6.1.2.2 or Struts 6.3.0.1 or greater, which fixe this issue.

The weakness was disclosed 09/15/2023 as S2-065. The advisory is shared for download at cwiki.apache.org. This vulnerability is handled as CVE-2023-41835 since 09/04/2023. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 2.5.32, 6.1.2.2 or 6.3.0.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Programming Tool Software

Vendor

• Apache

Name

• Struts

Version

• 2.5.0
• 2.5.1
• 2.5.2
• 2.5.3
• 2.5.4
• 2.5.5
• 2.5.6
• 2.5.7
• 2.5.8
• 2.5.9
• 2.5.10
• 2.5.11
• 2.5.12
• 2.5.13
• 2.5.14
• 2.5.15
• 2.5.16
• 2.5.17
• 2.5.18
• 2.5.19
• 2.5.20
• 2.5.21
• 2.5.22
• 2.5.23
• 2.5.24
• 2.5.25
• 2.5.26
• 2.5.27
• 2.5.28
• 2.5.29
• 2.5.30
• 2.5.31
• 6.0
• 6.1
• 6.1.2.0
• 6.1.2.1
• 6.2
• 6.3.0

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion