[FILEUPLOAD-212] Insecure request size checking

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 1.2.2
• Fix Version/s: 1.3
• Labels: max_upload_size resource_depletion security

Environment

Default configuration default environment.

• Assignee: Thomas Neidhart
• Reporter: Damian Kolasa
• Created: 15/Jul/12 08:55
• Updated: 03/Jun/17 17:19
• Resolved: 13/Mar/13 07:27

Description

In FileUploadBase there is an issue when checking for upload request size, the check is based on presence of Content-Length header in request and FALSE assumption that when present it will represent the actual request size. Using this fact, attacker can supply request with defined Content-Length of 60 and bypass file upload restrictions, which can lead to successful Resource Depletion type attack.

IMHO by default file upload should return the LimitedInputStream implementation for file upload.

Issue Links

• is related to: FILEUPLOAD-202 org.apache.commons.fileupload.FileUploadBase$IOFileUploadException: Processing of multipart/form-data request failed. Stream ended unexpectedly