CVE-2021-23597
📋 TL;DR
This vulnerability in fastify-multipart allows attackers to crash Node.js applications by sending multipart form data with a 'name=constructor' property. It affects applications using fastify-multipart versions before 5.3.1. This is a bypass of the previous CVE-2020-8136 fix.
💻 Affected Systems
- fastify-multipart
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Application denial of service causing complete unavailability of the service
Likely Case
Application crashes leading to service disruption and potential data loss in active sessions
If Mitigated
No impact if patched or proper input validation is implemented
🎯 Exploit Status
Simple HTTP request with crafted multipart data can trigger the crash
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.3.1
Vendor Advisory: https://github.com/fastify/fastify-multipart/releases/tag/v5.3.1
Restart Required: Yes
Instructions:
1. Update package.json to require 'fastify-multipart': '^5.3.1' 2. Run 'npm update fastify-multipart' or 'yarn upgrade fastify-multipart' 3. Restart the Node.js application
🔧 Temporary Workarounds
Input validation middleware
allAdd middleware to reject requests with 'name=constructor' in multipart data
🧯 If You Can't Patch
- Implement WAF rules to block requests with 'name=constructor' in multipart/form-data
- Use reverse proxy to filter malicious requests before they reach the application
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules for fastify-multipart version <5.3.1Check Version:
npm list fastify-multipartVerify Fix Applied:
Verify fastify-multipart version is 5.3.1 or higher in package.json and node_modules📡 Detection & Monitoring
Log Indicators:
- Application crash logs
- Unhandled exception errors mentioning 'constructor'
- Process termination without normal shutdown
Network Indicators:
- HTTP POST requests with multipart/form-data containing 'name=constructor'
SIEM Query:
http.method:POST AND http.content_type:'multipart/form-data' AND http.body:'name=constructor'🔗 References
- https://github.com/fastify/fastify-multipart/commit/a70dc7059a794589bd4fe066453141fc609e6066
- https://github.com/fastify/fastify-multipart/releases/tag/v5.3.1
- https://snyk.io/vuln/SNYK-JS-FASTIFYMULTIPART-2395480
- https://github.com/fastify/fastify-multipart/commit/a70dc7059a794589bd4fe066453141fc609e6066
- https://github.com/fastify/fastify-multipart/releases/tag/v5.3.1
- https://snyk.io/vuln/SNYK-JS-FASTIFYMULTIPART-2395480
