CVE-2025-64775
📋 TL;DR
This vulnerability in Apache Struts allows attackers to cause a denial of service through disk exhaustion by exploiting a file leak in multipart request processing. It affects all Apache Struts installations from versions 2.0.0 through 6.7.0 and 7.0.0 through 7.0.3. Attackers can send specially crafted multipart requests that cause temporary files to accumulate without cleanup.
💻 Affected Systems
- Apache Struts
📦 What is this software?
Struts by Apache
Struts by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete disk exhaustion leading to system crash, service unavailability, and potential data corruption if critical system partitions fill up.
Likely Case
Degraded application performance, service interruptions, and potential application crashes as disk space becomes exhausted.
If Mitigated
Minimal impact with proper monitoring and disk space management, though still vulnerable to targeted attacks.
🎯 Exploit Status
The vulnerability is straightforward to exploit and public proof-of-concept code is available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.8.0 or 7.1.1
Vendor Advisory: https://cwiki.apache.org/confluence/display/WW/S2-068
Restart Required: Yes
Instructions:
1. Identify your Struts version. 2. Download Struts 6.8.0 (for 2.x/6.x) or 7.1.1 (for 7.x). 3. Replace the Struts JAR files in your application. 4. Restart your application server. 5. Test application functionality.
🔧 Temporary Workarounds
Disable multipart request processing
allIf your application doesn't require file uploads, disable multipart request handling in Struts configuration.
In struts.xml: <constant name="struts.multipart.enabled" value="false" />
Implement request filtering
allUse web application firewall or reverse proxy to filter suspicious multipart requests.
Configure WAF rules to limit multipart request size and frequency
🧯 If You Can't Patch
- Implement strict disk space monitoring and alerts for temporary directories
- Deploy network-level controls to limit multipart request rates and sizes
🔍 How to Verify
Check if Vulnerable:
Check your Struts version against affected ranges. Examine application logs for excessive temporary file creation in multipart processing directories.Check Version:
Check WEB-INF/lib for struts2-core-*.jar version or examine Maven/Gradle dependenciesVerify Fix Applied:
Verify Struts version is 6.8.0+ or 7.1.1+. Test multipart file upload functionality works correctly without disk space issues.📡 Detection & Monitoring
Log Indicators:
- Rapid growth of temporary files in upload directories
- Disk space alerts
- Multiple failed multipart request attempts
Network Indicators:
- High volume of multipart POST requests
- Unusually large file upload attempts
- Requests with malformed multipart boundaries
SIEM Query:
source="*struts*" AND ("multipart" OR "upload") AND ("disk full" OR "no space" OR "temp file")