CVE-2021-3666
📋 TL;DR
CVE-2021-3666 is a prototype pollution vulnerability in the body-parser-xml npm package that allows attackers to inject arbitrary properties into JavaScript objects. This affects any application using vulnerable versions of body-parser-xml to parse XML request bodies. Successful exploitation can lead to denial of service, remote code execution, or other security impacts depending on the application context.
💻 Affected Systems
- body-parser-xml npm package
📦 What is this software?
Xml Body Parser by Xml Body Parser Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or service disruption.
Likely Case
Denial of service through application crashes or unexpected behavior, potentially enabling further attacks.
If Mitigated
Limited impact if input validation and sanitization are implemented, though prototype pollution remains dangerous.
🎯 Exploit Status
Exploitation requires sending specially crafted XML payloads. Public proof-of-concept code exists in the referenced GitHub commit and security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.3
Vendor Advisory: https://github.com/fiznool/body-parser-xml/commit/d46ca622560f7c9a033cd9321c61e92558150d63
Restart Required: Yes
Instructions:
1. Update package.json to specify body-parser-xml version 2.0.3 or higher. 2. Run 'npm update body-parser-xml' or 'yarn upgrade body-parser-xml'. 3. Restart the Node.js application to apply the update.
🔧 Temporary Workarounds
Disable XML parsing
allRemove or disable body-parser-xml middleware if XML parsing is not required.
Remove 'app.use(bodyParser.xml())' or similar lines from your application code
Input validation and sanitization
allImplement strict input validation and sanitization for XML payloads before processing.
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block malicious XML payloads containing prototype pollution patterns.
- Isolate affected applications in network segments with strict access controls and monitor for suspicious XML traffic.
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list body-parser-xml' to see if version is below 2.0.3.Check Version:
npm list body-parser-xml | grep body-parser-xmlVerify Fix Applied:
After updating, verify with 'npm list body-parser-xml' that version 2.0.3 or higher is installed.📡 Detection & Monitoring
Log Indicators:
- Unusual XML payloads in request logs
- Application errors or crashes during XML parsing
- Suspicious property injection patterns in debug logs
Network Indicators:
- XML payloads containing '__proto__', 'constructor', or 'prototype' properties
- Unusually large or malformed XML requests
SIEM Query:
source="application_logs" AND ("body-parser-xml" OR "XML parsing error") AND ("__proto__" OR "constructor" OR "prototype")