⬇ Download holy card: ·
⚔ Commemorated today: The Red Scourge of Code Red (2001)⚔ Commemorated today: The Friday of the Blue Screens (2024)Saint LOBSTER, Who Uploaded Files and Cooked Code
Patron of upload libraries, Apache Struts, and temporary files that stay when they should not.
Life
In 2016 Jacob Baines of Tenable revealed LOBSTER (CVE-2016-1000031), a flaw in the Apache Commons FileUpload library, used by Struts 2 to handle uploaded files. The DiskFileItem object could be manipulated to write files where it should not and run code remotely. The fix came with Commons FileUpload 1.3.3, amid some debate over who should really fix it.
Prayer
O Saint LOBSTER, who cooks code from uploaded files, teach our libraries never to write outside the plate. Amen.
How to celebrate
Celebrated by updating Commons FileUpload to 1.3.3 and, in Struts, replacing the old JAR with the fixed one.
A file uploaded unchecked is dinner served to the attacker.