Lucene search

K
githubGitHub Advisory DatabaseGHSA-QW69-RQJ8-6QW8
HistoryApr 19, 2023 - 6:15 p.m.

OutOfMemoryError for large multipart without filename in Eclipse Jetty

2023-04-1918:15:45
CWE-400
CWE-770
GitHub Advisory Database
github.com
13
servlets
multipart
outofmemoryerror
httpservletrequest
jetty
security issue

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

0.002

Percentile

61.3%

Impact

Servlets with multipart support (e.g. annotated with @MultipartConfig) that call HttpServletRequest.getParameter() or HttpServletRequest.getParts() may cause OutOfMemoryError when the client sends a multipart request with a part that has a name but no filename and a very large content.

This happens even with the default settings of fileSizeThreshold=0 which should stream the whole part content to disk.

An attacker client may send a large multipart request and cause the server to throw OutOfMemoryError.
However, the server may be able to recover after the OutOfMemoryError and continue its service โ€“ although it may take some time.

A very large number of parts may cause the same problem.

Patches

Patched in Jetty versions

  • 9.4.51.v20230217 - via PR #9345
  • 10.0.14 - via PR #9344
  • 11.0.14 - via PR #9344

Workarounds

Multipart parameter maxRequestSize must be set to a non-negative value, so the whole multipart content is limited (although still read into memory).
Limiting multipart parameter maxFileSize wonโ€™t be enough because an attacker can send a large number of parts that summed up will cause memory issues.

References

Affected configurations

Vulners
Node
org.eclipse.jetty\jettyMatchserver
OR
org.eclipse.jetty\jettyMatchserver
OR
org.eclipse.jetty\jettyMatchserver

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

0.002

Percentile

61.3%