CVE-2023-24998: Apache Commons FileUpload DoS Vulnerability

CVE-2023-24998 Overview

Apache Commons FileUpload before version 1.5 does not limit the number of request parts to be processed, resulting in the possibility of an attacker triggering a Denial of Service (DoS) attack with a malicious upload or series of uploads. This resource exhaustion vulnerability allows unauthenticated remote attackers to consume excessive server resources by sending requests with an unbounded number of file parts, effectively rendering the target application unresponsive.

The vulnerability exists because the file upload limits, including the new configuration option FileUploadBase#setFileCountMax, are not enabled by default and must be explicitly configured by application developers.

Critical Impact

Unauthenticated remote attackers can exhaust server resources and cause complete service disruption to applications using Apache Commons FileUpload for multipart form processing.

Affected Products

• Apache Commons FileUpload versions prior to 1.5
• Debian Linux 9.0
• Debian Linux 11.0

Discovery Timeline

• 2023-02-20 - CVE-2023-24998 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2023-24998

Vulnerability Analysis

This vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The Apache Commons FileUpload library is widely used in Java applications to handle multipart/form-data HTTP requests, commonly used for file uploads. The library parses incoming multipart requests and processes each part individually.

The core issue lies in the absence of a default limit on the number of request parts that can be processed in a single HTTP request. When an attacker submits a multipart request containing an extremely large number of parts (potentially thousands or millions), the server allocates resources for each part without restriction. This leads to memory exhaustion, CPU saturation, or thread pool depletion, ultimately resulting in a denial of service condition.

Root Cause

The root cause of CVE-2023-24998 is the lack of a default upper bound on the number of parts processed during multipart request parsing. The FileUploadBase class processes each part in the request sequentially, creating objects and allocating memory for each one. Without an explicit call to setFileCountMax(), there is no limit enforced, allowing an attacker to craft requests with an arbitrary number of parts.

This design decision was likely made to maximize flexibility for developers, but it creates a security gap when applications fail to explicitly configure limits. The fix introduced in version 1.5 adds the setFileCountMax() method, but importantly, this limit still must be explicitly enabled by the application developer.

Attack Vector

The attack can be executed remotely over the network without requiring any authentication or user interaction. An attacker crafts a malicious HTTP multipart request containing a very large number of file parts or form fields. When the vulnerable application processes this request, it attempts to parse and allocate resources for every part, leading to resource exhaustion.

The attack is particularly effective because multipart form processing typically occurs early in the request handling pipeline before authentication checks, allowing unauthenticated attackers to trigger the condition. An attacker could automate this attack to send multiple malicious requests, amplifying the denial of service impact.

Detection Methods for CVE-2023-24998

Indicators of Compromise

• Unusual spikes in memory consumption on application servers handling file uploads
• High CPU utilization during multipart request processing
• HTTP requests with abnormally large Content-Length headers or excessive boundary delimiters
• Thread pool exhaustion or application thread starvation logs

Detection Strategies

• Monitor for HTTP POST requests with Content-Type multipart/form-data containing unusually high numbers of boundary markers
• Implement application-level logging to track the number of parts processed per request
• Use web application firewall (WAF) rules to detect and block requests with excessive multipart boundaries
• Review server access logs for repeated large multipart uploads from single IP addresses

Monitoring Recommendations

• Configure alerts for memory and CPU threshold breaches on servers running affected applications
• Implement rate limiting on file upload endpoints to reduce attack surface
• Enable detailed logging for multipart request processing to capture part counts
• Monitor application response times for degradation patterns indicative of resource exhaustion

How to Mitigate CVE-2023-24998

Immediate Actions Required

• Upgrade Apache Commons FileUpload to version 1.5 or later
• Explicitly configure FileUploadBase#setFileCountMax() with an appropriate limit for your application
• Review all applications using Apache Commons FileUpload and inventory affected deployments
• Apply available security patches from Debian and other distributions as applicable

Patch Information

Apache has released version 1.5 of Commons FileUpload which introduces the setFileCountMax() configuration option. Organizations should upgrade to this version or later. Note that the fix requires explicit configuration—simply upgrading without setting a file count limit will not fully mitigate the vulnerability.

Additional security advisories have been released by multiple vendors:

• Apache Security Thread - Official Apache security announcement
• Debian Security Advisory DSA-5522 - Debian package updates
• Gentoo GLSA 202305-37 - Gentoo Linux security advisory
• NetApp Security Advisory NTAP-20230302-0013 - NetApp product guidance

Workarounds

• Implement a reverse proxy or WAF rule to limit the number of multipart boundaries in incoming requests
• Configure web server connection timeouts to limit the duration of request processing
• Implement request size limits at the web server or load balancer level
• Temporarily disable file upload functionality on affected endpoints until patches can be applied

# Example configuration for Apache Commons FileUpload 1.5+
# Add to your application initialization code:
# ServletFileUpload upload = new ServletFileUpload(factory);
# upload.setFileCountMax(100); // Set appropriate limit for your application
# upload.setSizeMax(10485760); // 10 MB total request size limit
# upload.setFileSizeMax(5242880); // 5 MB per file limit