Executive brief
express-fileupload is a Node.js library that handles file uploads in web applications. When the parseNested option is enabled, a maliciously crafted HTTP upload request can pollute the JavaScript prototype chain, allowing an attacker to execute arbitrary code or crash the server. This affects any web application using this library for file handling.
Technical details
A prototype pollution vulnerability exists in express-fileupload versions before 1.1.9 when the parseNested option is enabled. The vulnerability is triggered by sending a multipart form-data request with specially crafted field names (e.g., "__proto__.toString") that pollute the Object prototype. No authentication is required; the attack is network-accessible via malformed HTTP requests. An attacker can achieve denial of service or arbitrary code execution by injecting properties into the prototype chain. The fix was released in version 1.1.9 (commit db495357d).
Affected products
- Richard Girges express-fileupload before 1.1.9
Timeline
- 2020-07-29: disclosed
- 2020-08-03: patched: Fix released in version 1.1.9