CVE-2013-2186
published 2013-10-28CVE-2013-2186: The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server…
PriorityP352high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
12.77%
95.8th percentile
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tomcat | <= 7.0.39 | — |
| debian | libcommons-fileupload-java | < libcommons-fileupload-java 1.3-2.1 (bookworm) | libcommons-fileupload-java 1.3-2.1 (bookworm) |
| jenkins | certain_pages_in_monitoring_plugin | — | — |
| jenkins | jenkins_core | — | — |
| jenkins | monitoring_plugin | — | — |
| jenkins | user_of_monitoring_plugin | — | — |
| redhat | jboss_enterprise_application_platform | — | — |
| redhat | jboss_enterprise_brms_platform | — | — |
| redhat | jboss_enterprise_portal_platform | — | — |
| redhat | jboss_enterprise_portal_platform | — | — |
| redhat | jboss_enterprise_portal_platform | — | — |
| redhat | jboss_enterprise_web_server | — | — |
| redhat | openshift | <= 3.1 | — |
| ubuntu | ubuntu | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect deserialization of DiskFileItem class instances containing a NULL byte in the file name field — the core exploit primitive for this CVE ↗
- →Monitor for arbitrary file writes (especially .jsp files) to web-accessible directories following deserialization activity on Tomcat/JBoss endpoints, as exploitation can result in a malicious JSP being uploaded and executed ↗
- →Inspect serialized Java objects arriving over HTTP for the DiskFileItem class signature combined with NULL bytes (0x00) embedded within file name strings — this is the payload pattern for CVE-2013-2186 ↗
- ·Affected components are Apache Commons FileUpload (commons-fileupload) as used in Red Hat JBoss BRMS 5.3.1, JBoss Portal 4.3 CP07 / 5.2.2 / 6.0.0, and Red Hat JBoss Web Server 1.0.2 — detection should be scoped to these deployments ↗
- ·Versions of Tomcat shipped with Red Hat Enterprise Linux 5, 6, and 7 and Red Hat JBoss Web Server 1 and 2 are NOT affected — avoid false-positive alerting on those platforms ↗
- ·Red Hat Satellite 5 is explicitly not affected because defaultReadObject is not used in its code path — exclude from detection scope ↗
- ·The vulnerability requires an attacker to be able to supply a serialized DiskFileItem instance to the server for deserialization — exploitation is only possible where untrusted serialized data reaches the readObject method ↗
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa7.5HIGH
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Deserialization of Untrusted Data in Apache Tomcat
ghsa·2022-05-17·CVSS 7.5
CVE-2013-2185 [HIGH] CWE-502 Deserialization of Untrusted Data in Apache Tomcat
Deserialization of Untrusted Data in Apache Tomcat
The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.
NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue. Regardless the tomcat maintainers have altered the behavior of this method in version 7.0.39.
OSV
Deserialization of Untrusted Data in Apache Tomcat
osv·2022-05-17·CVSS 7.5
CVE-2013-2185 [HIGH] Deserialization of Untrusted Data in Apache Tomcat
Deserialization of Untrusted Data in Apache Tomcat
The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.
NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue. Regardless the tomcat maintainers have altered the behavior of this method in version 7.0.39.
GHSA
Arbitrary file write in Apache Commons Fileupload
ghsa·2022-05-14
CVE-2013-2186 [HIGH] CWE-20 Arbitrary file write in Apache Commons Fileupload
Arbitrary file write in Apache Commons Fileupload
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.
OSV
Arbitrary file write in Apache Commons Fileupload
osv·2022-05-14
CVE-2013-2186 [HIGH] Arbitrary file write in Apache Commons Fileupload
Arbitrary file write in Apache Commons Fileupload
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.
OSV
CVE-2013-2186: The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5
osv·2013-10-28·CVSS 7.5
CVE-2013-2186 [HIGH] CVE-2013-2186: The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.
Jenkins
Jenkins Security Advisory 2014-10-01
vendor_jenkins·2014-10-01·CVSS 5.0
CVE-2013-2186 [MEDIUM] Jenkins Security Advisory 2014-10-01
Title: Jenkins Security Advisory 2014-10-01
Jenkins Security Advisory 2014-10-01
This advisory announces:
multiple security vulnerabilities that were found in Jenkins core.
two security vulnerabilities found in the monitoring plugin
Description
SECURITY-87/CVE-2014-3661 (anonymous DoS attack through CLI handshake)
This vulnerability allows unauthenticated users with access to Jenkins' HTTP/HTTPS port to mount a DoS attack on Jenkins through thread exhaustion.
SECURITY-110/CVE-2014-3662 (User name discovery)
Anonymous users can test if the user of a specific name exists or not through login attempts.
SECURITY-127&128/CVE-2014-3663 (privilege escalation in job configuration permission)
An user with a permission limited to Job/CONF
Ubuntu
Apache Commons FileUpload vulnerability
vendor_ubuntu·2013-11-13
CVE-2013-2186 Apache Commons FileUpload vulnerability
Title: Apache Commons FileUpload vulnerability
Summary: Apache Commons FileUpload could be made to overwrite files.
It was discovered that Apache Commons FileUpload incorrectly handled file
names with NULL bytes in serialized instances. An attacker could use this
issue to possibly write to arbitrary files.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
commons-fileupload: Arbitrary file upload via deserialization
vendor_redhat·2013-10-15·CVSS 7.5
CVE-2013-2186 [HIGH] CWE-626 commons-fileupload: Arbitrary file upload via deserialization
commons-fileupload: Arbitrary file upload via deserialization
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.
Package: commons-fileupload (Red Hat JBoss BRMS 5) - Affected
Package: commons-fileupload (Red Hat JBoss Operations Network 3) - Affected
Package: commons-fileupload (Red Hat JBoss Portal 4) - Affected
Package: commons-fileupload (Red Hat JBoss Portal 5) - Affected
Package: commons-fileupload (Red Hat JBoss Portal 6) - Affected
Package: commons-fileupload (Red Hat JBoss SOA Platform 4) - Affected
Package: commons-fileupload (Red Hat JBoss SOA Platform
Red Hat
Tomcat/JBossWeb: Arbitrary file upload via deserialization
vendor_redhat·2013-09-03·CVSS 7.5
CVE-2013-2185 [HIGH] CWE-626 Tomcat/JBossWeb: Arbitrary file upload via deserialization
Tomcat/JBossWeb: Arbitrary file upload via deserialization
The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186. NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue
It was possible for an attacker, using complex and limited conditions, to upload a malicious JSP to a Tomca
Debian
CVE-2013-2186: libcommons-fileupload-java - The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BR...
vendor_debian·2013·CVSS 7.5
CVE-2013-2186 [HIGH] CVE-2013-2186: libcommons-fileupload-java - The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BR...
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.
Scope: local
bookworm: resolved (fixed in 1.3-2.1)
bullseye: resolved (fixed in 1.3-2.1)
forky: resolved (fixed in 1.3-2.1)
sid: resolved (fixed in 1.3-2.1)
trixie: resolved (fixed in 1.3-2.1)
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00008.htmlhttp://lists.opensuse.org/opensuse-updates/2013-10/msg00033.htmlhttp://lists.opensuse.org/opensuse-updates/2013-10/msg00050.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1428.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1429.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1430.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1442.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1448.htmlhttp://secunia.com/advisories/55716http://ubuntu.com/usn/usn-2029-1http://www.debian.org/security/2013/dsa-2827http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlhttp://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlhttp://www.securityfocus.com/bid/63174https://access.redhat.com/errata/RHSA-2016:0070https://exchange.xforce.ibmcloud.com/vulnerabilities/88133https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01https://www.tenable.com/security/research/tra-2016-23http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00008.htmlhttp://lists.opensuse.org/opensuse-updates/2013-10/msg00033.htmlhttp://lists.opensuse.org/opensuse-updates/2013-10/msg00050.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1428.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1429.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1430.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1442.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1448.htmlhttp://secunia.com/advisories/55716http://ubuntu.com/usn/usn-2029-1http://www.debian.org/security/2013/dsa-2827http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlhttp://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlhttp://www.securityfocus.com/bid/63174https://access.redhat.com/errata/RHSA-2016:0070https://exchange.xforce.ibmcloud.com/vulnerabilities/88133https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01https://www.tenable.com/security/research/tra-2016-23
2013-10-28
Published