Listen to this Post
The vulnerability in `io.jmix.localfs:jmix-localfs` allows attackers to trigger a DoS condition by exploiting insufficient file size restrictions in the local file storage implementation. When a malicious user uploads an excessively large file, the server’s storage capacity can be exhausted, leading to HTTP 500 errors and service unavailability. The issue stems from missing validation checks before processing file uploads via the `/files` endpoint.
Although the risk is partially mitigated by authentication requirements and disabled endpoints by default, authenticated attackers with sufficient permissions can still abuse this flaw. The vulnerability affects versions `1.0.0` to `1.6.1` and `2.0.0` to 2.3.0. Patches are available in versions `1.6.2` and 2.4.0.
DailyCVE Form:
Platform: Jmix Framework
Version: 1.0.0-1.6.1, 2.0.0-2.3.0
Vulnerability: DoS via file upload
Severity: Moderate
Date: 2025-04-22
What Undercode Say:
Exploitation:
1. Attacker authenticates to Jmix.
2. Sends oversized file via `/files` endpoint:
curl -X POST -H "Authorization: Bearer TOKEN" -F "[email protected]" http://target/files
3. Server storage fills, triggering DoS.
Protection:
1. Patch: Upgrade to `1.6.2` or `2.4.0`.
2. Workaround: Disable `/files` endpoint in `application.properties`:
jmix.localfs.enabled=false
3. Mitigation: Implement file size limits in Nginx/Apache:
client_max_body_size 10M;
4. Log Monitoring: Detect abnormal uploads:
grep "POST /files" /var/log/jmix.log | awk '{if($10 > 10000000) print "ALERT: Large file"}'
Code Fix (Custom Validator):
@Bean
public Validator<FileUpload> fileSizeValidator() {
return upload -> {
if (upload.getSize() > 10_000_000) {
throw new ValidationException("File too large");
}
};
}
Analytics:
- Attack Vector: Network (authenticated).
- CVSS Score: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
- Exploitability: Low (requires auth).
References:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
