CVE-2019-10792: Injection in bodymen
Summary
CVE-2019-10792: Injection in bodymen. Affects bodymen versions < 1.1.1. Fixed in 1.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bodymen package is an npm package that provides a middleware for parsing and validating request bodies in Node.js applications. It is commonly used to simplify the handling of request data and enforce data validation rules. However, versions before 1.1.1 of bodymen are vulnerable to Prototype Pollution. This vulnerability allows an attacker to manipulate the prototype of objects, potentially leading to unauthorized property additions or modifications.
Vulnerability Detail
The vulnerability in bodymen arises from a lack of proper input validation and sanitization. By crafting a malicious payload using the proto property, an attacker can inject arbitrary properties into the Object.prototype, which is the prototype of all JavaScript objects. This can have various consequences depending on how the affected codebase interacts with objects. For example, it could lead to unexpected behavior, privilege escalation, or even remote code execution if the manipulated properties are later used in a vulnerable manner.
How To Fix
Minimum fixed version
1.1.1
This is the first release that contains the fix.
npm install bodymen@1.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of bodymen is not immediately feasible, developers can implement input validation and sanitization measures manually to mitigate the risk of Prototype Pollution attacks. This can involve implementing strict input validation routines, avoiding the use of potentially unsafe functions or methods, and carefully reviewing any code that interacts with user-supplied data.
Conclusion
The bodymen package before version 1.1.1 is vulnerable to Prototype Pollution, which allows attackers to manipulate the prototype of objects and potentially introduce unauthorized changes to the affected codebase. To mitigate this vulnerability, it is crucial to upgrade to the latest version of bodymen or implement proper input validation and sanitization measures. For further assistance, reach out to DevNack.com.
See every vulnerability recorded for bodymen →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of objects, leading to unexpected behavior or security issues in the affected codebase.
The impact of this vulnerability depends on how the affected codebase interacts with objects. It could lead to unexpected behavior, privilege escalation, or even remote code execution if the manipulated properties are later used in a vulnerable manner.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, the CVSS score for this vulnerability is 6.3, indicating a moderate severity level.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability in your codebase.
References
Related vulnerabilities
Recent vulnerabilities recorded for bodymen.
