Is CVE-2024-45590 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-45590 being exploited in the wild.

How severe is CVE-2024-45590?

Low severity, with a CVSS score of 3.1, published 10 September 2024.

Which products and versions are affected?

Body-Parser SEMVER:introduced=0,fixed=1.20.3.

Is there a fix for CVE-2024-45590?

Yes. Body-Parser: upgrade to 1.20.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-45590 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-45590?

Check whether you run Body-Parser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-45590: body-parser denial of service in URL encoding

CVE-2024-45590 · Severity: low · CVSS 3.1 · Published 2024-09-10

body-parser is a middleware library used in Node.js web applications to parse incoming HTTP request bodies. Versions prior to 1.20.3 are vulnerable to denial of service attacks when URL encoding is enabled. An attacker can send specially crafted requests to overwhelm the server, causing it to become unresponsive and disrupting service availability for legitimate users.

Technologies: Body-Parser.

Quick answers

Is CVE-2024-45590 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-45590 being exploited in the wild.
How severe is CVE-2024-45590?: Low severity, with a CVSS score of 3.1, published 10 September 2024.
Which products and versions are affected?: Body-Parser SEMVER:introduced=0,fixed=1.20.3.
Is there a fix for CVE-2024-45590?: Yes. Body-Parser: upgrade to 1.20.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-45590 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-45590?: Check whether you run Body-Parser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Body-Parser: upgrade to 1.20.3 or later

Technical details

This is an asymmetric resource consumption vulnerability (CWE-405) in the URL encoding handler of body-parser. When URL encoding is enabled, a malicious actor can craft payloads that cause the parser to consume excessive computational resources or time, leading to denial of service. The vulnerability is network-accessible, requires no authentication or user interaction, and can be exploited remotely by sending a specially crafted request. The issue has been patched in version 1.20.3, and users should upgrade immediately.

Affected products

Express.js body-parser <1.20.3

Identifiers

CVE-2024-45590
GHSA-qwcr-r2fm-qrc7

Timeline

2024-09-10: disclosed
2024-09-10: patched: Fixed in version 1.20.3

References

https://github.com/expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.