CVE-2018-7560: Regular Expression Denial of Service in aws-lambda-multipart-parser
Summary
CVE-2018-7560: AWS Lambda parser is vulnerable to Regular Expression Denial of Service. Affects aws-lambda-multipart-parser versions < 0.1.2. Fixed in 0.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aws-lambda-multipart-parser is an NPM package used in AWS Lambda functions to parse multipart/form-data requests. It allows developers to handle file uploads and other form data in their serverless applications. However, versions before 0.1.2 of this package are vulnerable to a Regular Expression Denial of Service (ReDoS) issue.
Vulnerability Detail
The vulnerability arises from a Regular Expression pattern used in the package's index.js file to parse multipart/form-data boundary strings. An attacker can craft a malicious boundary string that triggers a ReDoS attack, causing the parser to consume excessive CPU resources and potentially leading to a denial of service. This vulnerability has a CVSS score of 7.5, indicating a high severity.
How To Fix
Minimum fixed version
0.1.2
This is the first release that contains the fix.
npm install aws-lambda-multipart-parser@0.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the package to the fixed version as soon as possible.
Conclusion
The aws-lambda-multipart-parser package before version 0.1.2 is vulnerable to a Regular Expression Denial of Service (ReDoS) issue. This can lead to a denial of service by consuming excessive CPU resources. To mitigate this vulnerability, it is crucial to update the package to version 0.1.2 or later. For further support, contact DevNack.com.
See every vulnerability recorded for aws-lambda-multipart-parser →
FAQ
The vulnerability can lead to a denial of service by consuming excessive CPU resources. This can disrupt the functionality of AWS Lambda functions that rely on the aws-lambda-multipart-parser package.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any vulnerable versions are detected.
There are no known public exploits for this vulnerability at the time of writing. However, it is still crucial to update to the fixed version to mitigate the risk.
No, updating to the fixed version is the recommended solution. There are no known workarounds or configuration changes that can effectively mitigate the risk.
For further support on vulnerability remediation, you can reach out to info@devnack.com. The DevNack team can provide guidance and assistance in addressing this vulnerability.
