HTTP: Apache Commons FileUpload Boundary Denial of Service

This signature detects attempts to exploit a known vulnerability against Apache Commons FileUpload. A successful attack can result in a denial-of-service condition.

Extended Description

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.

Affected Products

Apache tomcat

References

CVE: CVE-2023-24998

URL: http://tomcat.apache.org/security-7.html#fixed_in_apache_tomcat_7.0.70 http://securitytracker.com/id?1036900 http://markmail.org/message/kpfl7ax4el2owb3o http://tomcat.apache.org/security-7.html https://commons.apache.org/proper/commons-fileupload/security-reports.html

Short Name

HTTP:APACHE:FILEUPLOAD-DOS

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: Apache Commons FileUpload Boundary Denial of Service

Extended Description

Affected Products

References

Found a potential security threat?