Listen to this Post
The vulnerability exploits the multipart request handler in Apache Struts. When a specially crafted multipart/form-data request is sent, the framework parses it and creates temporary files on the server’s disk to store uploaded parts. A flaw in the exception handling logic for malformed requests causes these temporary files to not be deleted. An attacker can repeatedly send such malicious requests, each generating orphaned temporary files. This process can be automated to rapidly consume all available disk inodes and space on the server’s storage volume. The exhaustion of disk resources leads to a denial-of-service condition, crippling the application and potentially the host system, as no new files or logs can be written.
Platform: Apache Struts
Version: 2.0.0-6.7.0
Vulnerability: File Leak
Severity: Critical
date: 12/01/2025
Prediction: Patch released.
What Undercode Say:
Simulating disk exhaustion monitoring watch -n 1 'df -h /tmp; ls -la /tmp/.tmp | wc -l' Finding potentially vulnerable Struts configuration files find /path/to/webapps -name "struts-config.xml" -type f Checking for open files by the Java process (potential resource leak) lsof -p $(pgrep -f java) | grep /tmp | head -20
// Example of a malicious multipart request skeleton // The boundary and malformed part cause the file handle leak String maliciousRequest = "--boundary\r\n" + "Content-Disposition: form-data; name=\"file\"; filename=\"exploit.txt\"\r\n" + "Content-Type: text/plain\r\n\r\n" + "payload" + "\r\n--incomplete-boundary--"; // Malformed, triggers exception
How Exploit:
1. Attacker crafts malformed HTTP multipart request.
2. Sends request repeatedly to Struts endpoint.
- Server creates temp files but fails to delete them on error.
4. Disk space/inodes are exhausted, causing DoS.
Protection from this CVE:
Upgrade to Struts 6.8.0 or 7.1.1.
Implement rate limiting.
Monitor disk usage.
Use network-level filtering.
Impact:
Complete disk exhaustion.
Application and system Denial-of-Service.
Possible system instability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
