CVE-2014-0050
published 2014-04-01CVE-2014-0050: MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a…
PriorityP258high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
83.17%
99.6th percentile
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
Affected
70 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | commons_fileupload | <= 1.3 | — |
| apache | commons_fileupload | — | — |
| apache | commons_fileupload | — | — |
| apache | commons_fileupload | — | — |
| apache | commons_fileupload | — | — |
| apache | commons_fileupload | — | — |
| apache | commons_fileupload | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
| apache | tomcat | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandPOST request with Content-Type: multipart/form-data; boundary=<4092-byte boundary> and body of 4097 'b' bytes↗
- →Detect HTTP POST requests with a multipart/form-data Content-Type header containing an abnormally large boundary string (e.g., boundary parameter approaching or exceeding 4092 bytes), which is the attack vector for triggering the infinite loop in MultipartStream.java. ↗
- →The exploit sends a crafted Content-Type header for a multipart request that bypasses the loop's intended exit conditions in MultipartStream.java — monitor for multipart POST requests where the boundary value length is unusually large (thousands of characters). ↗
- →Sudden spike in CPU consumption on Tomcat/JBoss Web servers processing multipart requests may indicate active exploitation; the infinite loop causes sustained CPU exhaustion. ↗
- →Affected versions to flag in asset inventory: Apache Commons FileUpload 1.0 through 1.3 (pre-1.3.1), Apache Tomcat 7.0.0–7.0.50, and Tomcat 8.0.0-RC1 through 8.0.1. ↗
- ·Tomcat 6 is only affected via the Manager application (which bundles Commons FileUpload), not all multipart endpoints — scope detection accordingly. ↗
- ·Tomcat 8 uses a package-renamed copy of Apache Commons FileUpload internally; patching the standalone commons-fileupload library is NOT sufficient — Tomcat itself must be upgraded to 8.0.0-RC10 or later. ↗
- ·Red Hat Enterprise Linux 7's standalone tomcat package is NOT affected; focus remediation on embedded commons-fileupload/jbossweb components in JBoss/middleware products. ↗
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_apache7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu5.8MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Tomcat vulnerabilities
vendor_ubuntu·2014-03-06·CVSS 5.8
CVE-2013-4286 [MEDIUM] Tomcat vulnerabilities
Title: Tomcat vulnerabilities
Summary: Several security issues were fixed in Tomcat.
It was discovered that Tomcat incorrectly handled certain inconsistent
HTTP headers. A remote attacker could possibly use this flaw to conduct
request smuggling attacks. (CVE-2013-4286)
It was discovered that Tomcat incorrectly handled certain requests
submitted using chunked transfer encoding. A remote attacker could use this
flaw to cause the Tomcat server to stop responding, resulting in a denial
of service. (CVE-2013-4322)
It was discovered that Tomcat incorrectly applied the disableURLRewriting
setting when handling a session id in a URL. A remote attacker could
possibly use this flaw to conduct session fixation attacks. This issue
only applied to Ubuntu 12.04 LTS. (CVE-2014-0033)
It was discover
Red Hat
apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream
vendor_redhat·2014-02-06·CVSS 7.5
CVE-2014-0050 [HIGH] apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream
apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
A denial of service flaw was found in the way Apache Commons FileUpload, which is embedded in Tomcat and JBoss Web, handled small-sized buffers used by MultipartStream. A remote attacker could use this flaw to create a malformed Content-Type header for a multipart request, causing Tomcat to enter an infinite loop when processing such an incoming request.
Package: commons-fileupload (Red Hat BPM Suite 6)
Debian
CVE-2014-0050: libcommons-fileupload-java - MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apach...
vendor_debian·2014·CVSS 7.5
CVE-2014-0050 [HIGH] CVE-2014-0050: libcommons-fileupload-java - MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apach...
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
Scope: local
bookworm: resolved (fixed in 1.3.1-1)
bullseye: resolved (fixed in 1.3.1-1)
forky: resolved (fixed in 1.3.1-1)
sid: resolved (fixed in 1.3.1-1)
trixie: resolved (fixed in 1.3.1-1)
Apache
Apache tomcat: CVE-2014-0050
vendor_apache·CVSS 7.5
CVE-2014-0050 [HIGH] Apache tomcat: CVE-2014-0050
Apache tomcat: CVE-2014-0050
It was possible to craft a malformed Content-Type header for a multipart request that caused Apache Tomcat to enter an infinite loop. A malicious user could, therefore, craft a malformed request that triggered a denial of service. The root cause of this error was a bug in Apache Commons FileUpload. Tomcat 8 uses a packaged renamed copy of Apache Commons FileUpload to implement the requirement of the Servlet 3.0 and later specifications to support the processing of mime-multipart requests. Tomcat 8 was therefore affected by this issue. This was fixed in revision 1565163 . This issue was reported to the Apache Software Foundation on 04 Feb 2014 and accidently made public on 06 Feb 2014. Affects: 8.0.0-RC1 to 8.0.1 alpha, 26 Dec 2013 Fixed in Apache Tomcat 8.0.0-R
GHSA
Commons FileUpload Denial of service vulnerability
ghsa·2018-12-21
CVE-2014-0050 [HIGH] CWE-20 Commons FileUpload Denial of service vulnerability
Commons FileUpload Denial of service vulnerability
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
OSV
Commons FileUpload Denial of service vulnerability
osv·2018-12-21
CVE-2014-0050 [HIGH] Commons FileUpload Denial of service vulnerability
Commons FileUpload Denial of service vulnerability
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
OSV
CVE-2014-0050: MultipartStream
osv·2014-04-01·CVSS 7.5
CVE-2014-0050 [HIGH] CVE-2014-0050: MultipartStream
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
Suricata
ET WEB_SERVER Apache Tomcat Boundary Overflow DOS/File Upload Attempt
suricata·2014-02-12
CVE-2014-0050 ET WEB_SERVER Apache Tomcat Boundary Overflow DOS/File Upload Attempt
ET WEB_SERVER Apache Tomcat Boundary Overflow DOS/File Upload Attempt
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Apache Tomcat Boundary Overflow DOS/File Upload Attempt"; flow:established,to_server; http.method; content:"POST"; content:"Content-Type|3a|"; nocase; pcre:"/^[^\r\n]*?boundary\s*?=\s*?[^\r\n]/Ri"; isdataat:4091,relative; content:!"|0A|"; within:4091; http.header; content:"multipart/form-data"; fast_pattern; reference:url,blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.html; reference:cve,2014-0050; classtype:web-application-attack; sid:2018113; rev:4; metadata:created_at 2014_02_12, cve CVE_2014_0050, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_22;)
Exploit-DB
Apache Commons FileUpload and Apache Tomcat - Denial of Service
exploitdb·2014-02-12·CVSS 7.5
CVE-2014-0050 [HIGH] Apache Commons FileUpload and Apache Tomcat - Denial of Service
Apache Commons FileUpload and Apache Tomcat - Denial of Service
---
#################################################################################
# CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat Denial-of-Service #
# #
# Author: Oren Hafif, Trustwave SpiderLabs Research #
# This is a Proof of Concept code that was created for the sole purpose #
# of assisting system administrators in evaluating whether their applications #
# are vulnerable to this issue or not #
# #
# Please use responsibly. #
#################################################################################
require 'net/http'
require 'net/https'
require 'optparse'
require 'openssl'
options = {}
opt_parser = OptionParser.new do |opt|
opt.banner = "Usage: ./CVE-2014-0050.rb [OPTIONS]"
opt.separator ""
o
Metasploit
Apache Commons FileUpload and Apache Tomcat DoS
metasploit
Apache Commons FileUpload and Apache Tomcat DoS
Apache Commons FileUpload and Apache Tomcat DoS
This module triggers an infinite loop in Apache Commons FileUpload 1.0 through 1.3 via a specially crafted Content-Type header. Apache Tomcat 7 and Apache Tomcat 8 use a copy of FileUpload to handle mime-multipart requests, therefore, Apache Tomcat 7.0.0 through 7.0.50 and 8.0.0-RC1 through 8.0.1 are affected by this issue. Tomcat 6 also uses Commons FileUpload as part of the Manager application.
Bugzilla
Upgrade apache-commons-fileupload to 1.3.1 to address CVE-2014-0050
bugzilla·2014-03-19·CVSS 7.5
CVE-2014-0050 [HIGH] Upgrade apache-commons-fileupload to 1.3.1 to address CVE-2014-0050
Upgrade apache-commons-fileupload to 1.3.1 to address CVE-2014-0050
Upgrade apache-commons-fileupload from 1.2.2 to 1.3.1 to address CVE-2014-0050 (BZ#1064682)
This was shipped as a 0-day patch with 6.0.1 release and now needs to be included as part of the product itself.
Discussion:
The roll up patch is handled in bug 1076709.
---
Kris, sure, but I 'll be doing a blind upgrade...: if it compiles, I 'll push it. (I can't run wb locally). Is that ok?
Here's an overview where commons-fileupload is used:
$ script/find-all.sh pom.xml commons-fileupload
./guvnor/guvnor-services/guvnor-services-backend/pom.xml: commons-fileupload
./guvnor/guvnor-services/guvnor-services-backend/pom.xml: commons-fileupload
./guvnor/guvnor-m2repo-editor/guvnor-m2repo-editor-backend/pom.xml: commons-fileuplo
Bugzilla
CVE-2014-0050 apache-commons-fileupload: denial of service due to too-small buffer size used bt MultipartStream [fedora-all]
bugzilla·2014-02-13·CVSS 7.5
CVE-2014-0050 [HIGH] CVE-2014-0050 apache-commons-fileupload: denial of service due to too-small buffer size used bt MultipartStream [fedora-all]
CVE-2014-0050 apache-commons-fileupload: denial of service due to too-small buffer size used bt MultipartStream [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes fie
Bugzilla
CVE-2014-0050 tomcat: apache-commons-fileupload: denial of service due to too-small buffer size used bt MultipartStream [fedora-all]
bugzilla·2014-02-13·CVSS 7.5
CVE-2014-0050 [HIGH] CVE-2014-0050 tomcat: apache-commons-fileupload: denial of service due to too-small buffer size used bt MultipartStream [fedora-all]
CVE-2014-0050 tomcat: apache-commons-fileupload: denial of service due to too-small buffer size used bt MultipartStream [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi n
Bugzilla
CVE-2014-0050 apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream
bugzilla·2014-02-06·CVSS 7.5
CVE-2014-0050 [HIGH] CVE-2014-0050 apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream
CVE-2014-0050 apache-commons-fileupload: denial of service due to too-small buffer size used by MultipartStream
A flaw was found in Apache Commons FileUpload. Specially-crafted input could trigger a denial of service if the buffer used by the MultipartStream was not big enough.
Tomcat 7 includes an embedded copy of Apache Commons FileUpload, so it was possible to craft a malformed Content-Type header for a multipart request which would cause Tomcat to enter an infinite loop.
This has been corrected in Tomcat 7 via commit r1565169 [1]. It has been corrected in Apache Commons FileUpload via commit r1565143 [2].
No new releases have been made with the changes; Tomcat 7.0.51 (not yet released) will correct this flaw.
[1] http://svn.apache.org/viewvc?view=revision&revision=1565169
[2] http
arXiv
Impact assessment for vulnerabilities in open-source software libraries
arxiv_fulltext·2015-04-21
Impact assessment for vulnerabilities in open-source software libraries
fancy
Software applications integrate more and more open-source software
(OSS) to benefit from code reuse. As a drawback, each vulnerability
discovered in bundled OSS potentially affects the application. Upon
the disclosure of every new vulnerability, the application vendor has
to decide whether it is exploitable in his particular usage context,
hence, whether users require an urgent application patch containing a
non-vulnerable version of the OSS. Current decision making is mostly
based on high-level vulnerability descriptions and expert knowledge,
thus, effort intense and error prone. This paper proposes a pragmatic
approach to facilitate the impact assessment, describes a
proof-of-concept for Java, and examines one example vulnerability as
case study. The approach is independent from s
http://advisories.mageia.org/MGASA-2014-0110.htmlhttp://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.htmlhttp://jvn.jp/en/jp/JVN14876762/index.htmlhttp://jvndb.jvn.jp/jvndb/JVNDB-2014-000017http://mail-archives.apache.org/mod_mbox/commons-dev/201402.mbox/%3C52F373FC.9030907%40apache.org%3Ehttp://marc.info/?l=bugtraq&m=143136844732487&w=2http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0252.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0253.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0400.htmlhttp://seclists.org/fulldisclosure/2014/Dec/23http://secunia.com/advisories/57915http://secunia.com/advisories/58075http://secunia.com/advisories/58976http://secunia.com/advisories/59039http://secunia.com/advisories/59041http://secunia.com/advisories/59183http://secunia.com/advisories/59184http://secunia.com/advisories/59185http://secunia.com/advisories/59187http://secunia.com/advisories/59232http://secunia.com/advisories/59399http://secunia.com/advisories/59492http://secunia.com/advisories/59500http://secunia.com/advisories/59725http://secunia.com/advisories/60475http://secunia.com/advisories/60753http://svn.apache.org/r1565143http://tomcat.apache.org/security-7.htmlhttp://tomcat.apache.org/security-8.htmlhttp://www-01.ibm.com/support/docview.wss?uid=swg21669554http://www-01.ibm.com/support/docview.wss?uid=swg21675432http://www-01.ibm.com/support/docview.wss?uid=swg21676091http://www-01.ibm.com/support/docview.wss?uid=swg21676092http://www-01.ibm.com/support/docview.wss?uid=swg21676401http://www-01.ibm.com/support/docview.wss?uid=swg21676403http://www-01.ibm.com/support/docview.wss?uid=swg21676405http://www-01.ibm.com/support/docview.wss?uid=swg21676410http://www-01.ibm.com/support/docview.wss?uid=swg21676656http://www-01.ibm.com/support/docview.wss?uid=swg21676853http://www-01.ibm.com/support/docview.wss?uid=swg21677691http://www-01.ibm.com/support/docview.wss?uid=swg21677724http://www-01.ibm.com/support/docview.wss?uid=swg21681214http://www.debian.org/security/2014/dsa-2856http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-015/index.htmlhttp://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-016/index.htmlhttp://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS14-017/index.htmlhttp://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htmhttp://www.mandriva.com/security/advisories?name=MDVSA-2015:084http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlhttp://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlhttp://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlhttp://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.htmlhttp://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.htmlhttp://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.htmlhttp://www.securityfocus.com/archive/1/532549/100/0/threadedhttp://www.securityfocus.com/archive/1/534161/100/0/threadedhttp://www.securityfocus.com/bid/65400http://www.ubuntu.com/usn/USN-2130-1http://www.vmware.com/security/advisories/VMSA-2014-0007.htmlhttp://www.vmware.com/security/advisories/VMSA-2014-0008.htmlhttp://www.vmware.com/security/advisories/VMSA-2014-0012.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1062337https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722https://security.gentoo.org/glsa/202107-39http://advisories.mageia.org/MGASA-2014-0110.htmlhttp://blog.spiderlabs.com/2014/02/cve-2014-0050-exploit-with-boundaries-loops-without-boundaries.htmlhttp://jvn.jp/en/jp/JVN14876762/index.htmlhttp://jvndb.jvn.jp/jvndb/JVNDB-2014-000017http://mail-archives.apache.org/mod_mbox/commons-dev/201402.mbox/%3C52F373FC.9030907%40apache.org%3Ehttp://marc.info/?l=bugtraq&m=143136844732487&w=2http://packetstormsecurity.com/files/127215/VMware-Security-Advisory-2014-0007.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0252.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0253.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0400.htmlhttp://seclists.org/fulldisclosure/2014/Dec/23http://secunia.com/advisories/57915http://secunia.com/advisories/58075http://secunia.com/advisories/58976http://secunia.com/advisories/59039http://secunia.com/advisories/59041http://secunia.com/advisories/59183http://secunia.com/advisories/59184http://secunia.com/advisories/59185http://secunia.com/advisories/59187http://secunia.com/advisories/59232http://secunia.com/advisories/59399http://secunia.com/advisories/59492http://secunia.com/advisories/59500http://secunia.com/advisories/59725http://secunia.com/advisories/60475http://secunia.com/advisories/60753http://svn.apache.org/r1565143http://tomcat.apache.org/security-7.htmlhttp://tomcat.apache.org/security-8.htmlhttp://www-01.ibm.com/support/docview.wss?uid=swg21669554
+ 38 more references
2014-04-01
Published