CVE-2022-29623
📋 TL;DR
CVE-2022-29623 is an arbitrary file upload vulnerability in Express Connect-Multiparty 2.2.0 that allows attackers to upload malicious PDF files, potentially leading to remote code execution. This affects web applications using the vulnerable middleware for file uploads. The vulnerability stems from insufficient file type validation.
💻 Affected Systems
- Express Connect-Multiparty
📦 What is this software?
Connect Multiparty by Connect Multiparty Project
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise with attacker gaining shell access, data exfiltration, and lateral movement within the network.
Likely Case
File system access allowing attackers to read sensitive files, modify application data, or deploy web shells for persistent access.
If Mitigated
Upload attempts are blocked or quarantined with no successful exploitation.
🎯 Exploit Status
YouTube videos demonstrate exploitation techniques. The vulnerability requires file upload functionality to be accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Upgrade to connect-multiparty 2.2.1 or later
Vendor Advisory: https://github.com/expressjs/connect-multiparty/releases/tag/2.2.0
Restart Required: Yes
Instructions:
1. Update package.json to use connect-multiparty >=2.2.1. 2. Run 'npm update connect-multiparty'. 3. Restart the Node.js application.
🔧 Temporary Workarounds
Implement File Type Validation
allAdd server-side validation to reject PDF files or implement strict file type checking
Disable File Uploads
allTemporarily disable file upload functionality until patching is complete
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block malicious file uploads
- Isolate the vulnerable application in a restricted network segment
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list connect-multiparty' to see if version 2.2.0 is installedCheck Version:
npm list connect-multiparty | grep connect-multipartyVerify Fix Applied:
Verify installed version is 2.2.1 or later using 'npm list connect-multiparty'📡 Detection & Monitoring
Log Indicators:
- Unusual file upload attempts, especially PDF files with suspicious names or content
- Errors from file validation middleware
Network Indicators:
- HTTP POST requests to upload endpoints with PDF files
- Unusual outbound connections from the application server
SIEM Query:
source="web_server" AND (method="POST" AND uri="*upload*" AND file_extension="pdf")