Executive brief
bodymen is a Node.js library for parsing and validating HTTP request bodies in web applications. A prototype pollution vulnerability in versions before 1.1.1 allows an attacker with network access to inject malicious properties into JavaScript object prototypes, potentially enabling privilege escalation, account takeover, or data tampering in any application using the library.
Technical details
The vulnerability is a prototype pollution flaw (CWE-74) in bodymen's request body handler that fails to properly sanitize input containing "__proto__" or "constructor.prototype" payloads. An unauthenticated attacker can send crafted HTTP requests with these payloads to modify Object.prototype properties, affecting all objects in the application's runtime. The attack requires network access to the application but no prior authentication or user interaction. Successful exploitation allows an attacker to bypass security checks, modify application behavior, or inject arbitrary properties. The vulnerability was patched in version 1.1.1 via commit 5d52e8c, which implements proper input sanitization.
Affected products
- bodymen bodymen before 1.1.1
Timeline
- 2021-04-13: disclosed: Published on GitHub Advisory Database
- 2020-02-18: patched: Fix merged in commit 5d52e8c, version 1.1.1