CVE-2013-2186 Arbitrary file write in Apache Commons Fileupload
Remote attackers can write arbitrary files via NULL byte injection in serialized instances, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-2186?
CVE-2013-2186 is a high-severity unsafe deserialization vulnerability in Redhat Openshift, published on 28 Oct 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.
Weakness: CWE-20
Which versions are affected by CVE-2013-2186?
2 open source packages ship an affected version, including commons-fileupload:commons-fileupload. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
commons-fileupload:commons-fileupload Maven | All versions | 1.3.1 |
commons-fileupload:commons-fileupload Maven | All versions | 1.3.1 |
Linux distribution packages (2)
jakarta-commons-fileupload Red Hat:jboss_enterprise_web_server:1::el5 | All versions | 1:1.1.1-7.7.ep5.el5 |
jakarta-commons-fileupload Red Hat:jboss_enterprise_web_server:1::el6 | All versions | 1:1.1.1-7.7.ep5.el6 |
Products include Redhat Jboss Enterprise Brms Platform, Redhat Jboss Enterprise Portal Platform, Redhat Jboss Enterprise Web Server, Redhat Openshift, Ubuntu Ubuntu.
How do I fix CVE-2013-2186?
Upgrade commons-fileupload:commons-fileupload to 1.3.1 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2013-2186 being exploited?
There is no known exploitation of CVE-2013-2186 in the wild and no public exploit code.
Public exploit code: 3 proofs of concept on GitHub.
Other vulnerabilities in Redhat Openshift
Sources
Also known as DEBIAN-CVE-2013-2186, DSA-2827-1, GHSA-qx6h-9567-5fqw, RHSA-2013:1428.