Review

The DiskFileItem class in Apache Wicket allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFileItem, and if running on a Java VM before 1.3.1, execute arbitrary code via a crafted serialized Java object

org/apache/wicket/util/upload/DiskFileItem.java

readObject(ObjectInputStream)

class DiskFileItem {
	/**
	 * Reads the state of this object during deserialization.
	 * 
	 * @param in
	 *            The stream from which the state should be read.
	 * 
	 * @throws IOException
	 *             if an error occurs.
	 * @throws ClassNotFoundException
	 *             if class cannot be found.
	 */
	private void readObject(final ObjectInputStream in) throws IOException, ClassNotFoundException
	{
		// read values
		in.defaultReadObject();

		OutputStream output = getOutputStream();
		if (cachedContent != null)
		{
			output.write(cachedContent);
		}
		else
		{
			FileInputStream input = new FileInputStream(dfosFile);
			Streams.copy(input, output);
			Files.remove(dfosFile);
			dfosFile = null;
		}
		output.close();

		cachedContent = null;
	}

}