Executive brief
Express-FileUpload is a widely-used Node.js library that handles file uploads in web applications. A vulnerability allows attackers to upload multiple files with identical names, overwriting legitimate files on the server. This could lead to replacement of critical application files, configuration files, or user data, disrupting service availability or enabling further attacks.
Technical details
The vulnerability is a CWE-434 (Unrestricted Upload of File with Dangerous Type) arbitrary file write flaw in Express-FileUpload v1.3.1 and earlier versions. When multiple files are uploaded with the same name, the library fails to prevent overwriting existing files without proper validation. The attack requires network access and no authentication; an attacker can craft HTTP requests with multiple file uploads to replace files on the server. This can result in service disruption, data loss, or execution of malicious code if the overwritten files are executable. A patch has been released in later versions of the package.
Affected products
- Express-FileUpload express-fileupload through 1.3.1
Timeline
- 2022-04-13: disclosed
- 2022-04-12: other: NVD published