Executive brief
bodymen is a body parser middleware for Node.js/Express applications that validates and formats incoming request data. A prototype pollution vulnerability allows attackers to inject malicious properties into JavaScript object prototypes via specially crafted request payloads, potentially modifying application behavior, corrupting data, or enabling further attacks.
Technical details
The vulnerability is a prototype pollution flaw in bodymen's handler function that fails to properly sanitize the `__proto__` and `constructor.prototype` payloads in request bodies. An attacker with network access can send a crafted POST request containing proto-based payloads to modify Object.prototype properties across the application. This vulnerability stems from an incomplete fix to a prior prototype pollution issue (CVE-2019-10792). No special authentication or user interaction is required; exploitation requires only network access to a running application using bodymen. The impact includes potential information disclosure, data corruption, and code execution depending on application logic.
Affected products
- diegohaz bodymen 0.0.0 and later
Timeline
- 2022-03-18: disclosed
- 2022-03-17: other: Published to NVD