Listen to this Post
This vulnerability is a file leak in the multipart request processing mechanism of Apache Struts. When a file upload request is malformed or interrupted, the framework fails to clean up the temporarily created files on the server’s disk. An attacker can exploit this by repeatedly sending malicious multipart requests. Each failed request leaves behind temporary files that are not deleted. Over time, this accumulation consumes all available disk inodes or space on the server. This leads to a complete Denial of Service, as the application and potentially the underlying operating system can no longer function due to the lack of free storage. The attack is low-complexity and does not require authentication, making it easy to execute remotely against vulnerable endpoints.
Platform: Apache Struts
Version: 2.0.0-6.7.4
Vulnerability: Disk Exhaustion DoS
Severity: High
Date: 2025-12-10
Prediction: Patch Released 2025-12-10
What Undercode Say:
find /tmp -name "struts" -type f -mtime +0 -ls df -ih /tmp cat /proc/sys/fs/file-nr
Simulate request leaving temp file upload_request --malformed-payload /endpoint
How Exploit:
Send repeated malformed multipart uploads.
Target any file upload endpoint.
Exhaust disk inodes/filespace.
Protection from this CVE
Upgrade to Struts 6.8.0.
Upgrade to Struts 7.1.1.
Monitor /tmp partition usage.
Implement rate-limiting on endpoints.
Impact:
Complete system unavailability.
Disk space exhaustion.
Service Denial of Service.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
