Apache Struts ActionForm Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in Apache Struts versions prior to 1.2.9, when used with BeanUtils 1.7. The issue arises in the ActionForm component, where remote attackers can exploit multipart/form-data encoded forms. By including a parameter that references the public getMultipartRequestHandler method, attackers may disrupt the application's normal operation, potentially causing it to crash or leading to unauthorized access to sensitive information.

Impact

Exploitation of this vulnerability can cause the web application to crash, leading to a denial-of-service condition. Additionally, there is a possibility of gaining access to sensitive information.

Remediation

Users are advised to upgrade to the latest version of Apache Struts (1.2.9 or later) available from the Apache Struts Project website.