Listen to this Post
How the CVE Works:
The CVE-2025-66675 vulnerability exists in the multipart request handler of Apache Struts. When the framework processes file uploads via multipart/form-data requests, it creates temporary files on the server’s disk. A flaw causes these temporary files not to be properly cleaned up after request processing is complete, regardless of whether the operation succeeds or fails. An attacker can exploit this by sending a high volume of multipart requests to the vulnerable endpoint. Each request leaks a small amount of disk space by leaving behind unused temporary files. By automating this process, an attacker can perform a low-and-slow attack that gradually consumes all available disk inodes and space on the server. This leads to disk exhaustion, which causes a denial of service as the application and potentially the underlying operating system can no longer write new files or logs, crashing or severely degrading service availability. The attack is persistent because the leaked files remain until manually cleaned. The vulnerability affects the default configuration and requires no special permissions to exploit, making it highly accessible to attackers.
DailyCVE Form:
Platform: Apache Struts
Version: 2.0.0-6.7.4
Version: 7.0.0-7.0.3
Vulnerability: File leak
Severity: Critical
date: 2025-12-10
Prediction: 2025-12-31
What Undercode Say:
Monitor for suspicious multipart request volume sudo find /tmp -name "struts.tmp" -type f | wc -l sudo df -h /tmp Example malicious curl request (conceptual) curl -X POST http://target/upload -F "[email protected]" Cleanup script for affected versions find /tmp -name "struts.tmp" -mtime +0 -delete
How Exploit:
An attacker sends repeated HTTP POST requests with multipart file upload data to any Struts action configured to handle file uploads. The attacker does not need the upload to succeed; the mere processing of the request triggers the file creation bug. Automated tools are used to send thousands of requests, each leaving a small temporary file on disk. The server’s storage fills until the system fails.
Protection from this CVE:
Upgrade to Struts 6.8.0 or 7.1.1. Implement web application firewalls to limit multipart request rates. Monitor server disk space and inode usage for unusual depletion. Regularly audit and clean temporary directories.
Impact:
Complete disk exhaustion leads to system instability and service outage. Prevents logging, file operations, and can crash the application server. Results in sustained denial of service requiring manual intervention to clear disk space and restart services.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
