Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows

Vulnerability

Overview

CVE-2023-42794 is an incomplete cleanup vulnerability in Apache Tomcat's internal fork of Commons FileUpload, affecting versions 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 on Windows [1]. The flaw originates from an unreleased refactoring that introduced a failure to delete temporary files when a web application opens an uploaded file stream but does not close it [2].

Exploitation

Conditions

On Windows platforms, if a web application opens an InputStream for an uploaded file and fails to properly close it, the temporary file remains on disk indefinitely [2]. No special privileges or authentication is required beyond the ability to upload files through a vulnerable Tomcat-based application. The attack surface is limited to applications that rely on Tomcat's file upload handling and misuse the stream lifecycle.

Impact

An attacker can repeatedly exploit this memory leak by uploading files, causing temporary files to accumulate on disk over time [1]. Because the files are never deleted, this can lead to the filesystem becoming full, resulting in a denial of service (DoS) condition where the server can no longer operate normally [2]. The impact is cumulative and may take time to manifest, but it does not require high complexity or privileges.

Mitigation

Apache has addressed the issue in Tomcat 9.0.81 and 8.5.94 [1]. Users are strongly recommended to upgrade to these or later versions. As an interim workaround, applications should ensure that all input streams for uploaded files are properly closed in a finally block. End-of-life (EOL) Tomcat versions may also be vulnerable but will not receive patches [1].