Executive brief
AWS Lambda multipart parser is a library that processes file uploads and form data in serverless applications. An attacker can send a specially crafted multipart form submission that causes the parser to consume excessive CPU, degrading or stopping the Lambda function's ability to process legitimate requests.
Technical details
The aws-lambda-multipart-parser NPM package versions before 0.1.2 contain a Regular Expression Denial of Service (ReDoS) vulnerability in index.js. The vulnerability exists in the regex pattern used to parse the multipart/form-data boundary string from the Content-Type header. An attacker can craft a malicious boundary string that causes catastrophic backtracking in the regex engine, consuming CPU resources and causing denial of service. The vulnerability is triggered when processing HTTP requests with multipart form data, which is network-reachable and requires no authentication or user interaction. A patch was made available in version 0.1.2.
Affected products
- npm aws-lambda-multipart-parser before 0.1.2
Timeline
- 2018-03-05: disclosed
- 2018-03-05: patched: Fixed in version 0.1.2