Executive brief
@hapi/pez is a Node.js library that parses multipart HTTP request payloads commonly used by web applications. A prototype pollution vulnerability allows an attacker to craft malicious multipart requests that modify the payload object's prototype, potentially bypassing security validations or causing application crashes. This could lead to unauthorized access to sensitive data or service disruption.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in @hapi/pez versions prior to 5.0.1 and 4.1.2. An attacker can construct a specially-crafted multipart request where one of the parts' content is set as the entire payload object's prototype. If the injected prototype contains data, it may bypass authorization and privacy controls; if it evaluates to null, it triggers unhandled exceptions when the payload is accessed. The attack requires only the ability to send a malicious HTTP multipart request (network-accessible, no authentication required). Patches are available in version 5.0.1 and later, with a backport for version 4.1.2.
Affected products
- hapi pez prior to 4.1.2 and prior to 5.0.1
Timeline
- 2020-09-03: disclosed