Executive brief
body-parser-xml is a middleware component used by web applications to process XML data. A security flaw in this component allows an attacker to manipulate the underlying structure of the application's programming environment. This can lead to unauthorized data access, service crashes, or complete takeover of the web server.
Technical details
The body-parser-xml library is vulnerable to Prototype Pollution (CWE-1321) due to improper validation of XML input during the parsing process. An attacker can send a specially crafted XML payload containing properties like '__proto__' or 'constructor' to modify the prototype of base JavaScript objects. This vulnerability can be exploited remotely without authentication, potentially leading to Remote Code Execution (RCE), Denial of Service (DoS), or bypass of security checks depending on how the application uses the polluted objects. The issue was addressed in version 2.0.3 by explicitly deleting sensitive prototype properties from the parsed XML object.
Affected products
- fiznool body-parser-xml < 2.0.3
Timeline
- 2021-09-13: advisory: NVD publication date
- 2021-09-14: disclosed: GHSA advisory published
- 2021-09-14: patched: Fix committed in version 2.0.3