Apache Commons Compress is a popular Java library that helps developers work with archive and compression formats like ZIP, TAR, and others. But if you use any version from 1.3 through 1.25., you are at risk due to a serious vulnerability: CVE-2024-25710. In this post, I’ll break it down in simple terms, show you code snippets, and tell you how to stay safe.

What is CVE-2024-25710? (In Plain English)

CVE-2024-25710 is a vulnerability known as a “Loop with Unreachable Exit Condition” or “Infinite Loop.” It means that an attacker can craft a malicious archive file and make your software, when using Apache Commons Compress, get stuck in a loop that never ends. This can freeze your application and eat up CPU and memory, leading to denial of service (DoS).

Vulnerable versions: From 1.3 up to and including 1.25.
Safe version: 1.26. and later

Official Advisory:
https://nvd.nist.gov/vuln/detail/CVE-2024-25710
Apache Security: https://lists.apache.org/thread/fm2bvpxpr6kxrmp2tlk8fvdpqfd3qt96

How Does This Happen in the Code?

Apache Commons Compress deals with different archive formats. If someone uploads or you process a malicious archive (say, a .tar file), the library could get stuck in an endless loop due to a bug in how it processes certain headers.

Here’s a simplified version of code that could trigger the issue

import org.apache.commons.compress.archivers.tar.TarArchiveInputStream;
import java.io.ByteArrayInputStream;

public class InfiniteLoopDemo {
    public static void main(String[] args) throws Exception {
        // This represents a malicious crafted TAR file.
        byte[] maliciousTar = ...; // ATTACKER SUPPLIES THIS

        try (TarArchiveInputStream tin = new TarArchiveInputStream(
                new ByteArrayInputStream(maliciousTar))) {
            // This gets stuck in an infinite loop with malicious data!
            while (tin.getNextTarEntry() != null) {
                // Would never exit for the crafted input
            }
        }
    }
}

In real life, the payload for maliciousTar would be crafted to trigger the loop, but you get the idea. Any service parsing user-supplied archives (uploads, batch jobs, etc.) could lock up.

The Exploit: What Can Attackers Do?

The attacker uploads or gets you to process a specially crafted archive.
- Your process/library method never returns.

How Bad is It?

It does not allow code execution or data theft, but it *is* quite serious for reliability. If attackers can trigger this at will (for example, with public upload features), it can be used at scale to bring down services.

The Fix: How do I Stay Safe?

Solution: Upgrade to Apache Commons Compress version 1.26. or later.

How to upgrade (Maven)

<dependency>
    <groupId>org.apache.commons</groupId>
    <artifactId>commons-compress</artifactId>
    <version>1.26.</version>
</dependency>

After upgrading, rebuild and redeploy your application.

For Gradle

implementation 'org.apache.commons:commons-compress:1.26.'

References

- NVD Entry for CVE-2024-25710
- Apache Mailing List Announcement
- GitHub Commons Compress project
- Official Apache Commons Compress Download

Conclusion

CVE-2024-25710 is a classic “infinite loop” bug that attackers can trigger with a malicious archive file, causing your Java server to hang and possibly be denied to legitimate users. It impacts any project using Apache Commons Compress 1.3 through 1.25. to handle input from untrusted sources. Upgrading to 1.26. closes the hole.

Don’t wait—check your dependencies! Upgrade if you’re at risk and keep your projects and users safe.

Timeline

Published on: 02/19/2024 09:15:37 UTC
Last modified on: 03/07/2024 17:15:12 UTC