CVE-2024-29409
📋 TL;DR
A file upload vulnerability in NestJS allows remote attackers to execute arbitrary code by manipulating the Content-Type header. This affects NestJS applications using affected versions that handle file uploads. Attackers can potentially gain server-side code execution.
💻 Affected Systems
- NestJS
📦 What is this software?
Nest by Nestjs
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Server-side code execution allowing file system access, data exfiltration, and potential privilege escalation.
If Mitigated
Request blocked or sanitized, preventing code execution but potentially causing service disruption.
🎯 Exploit Status
Proof of concept available in GitHub gist. Exploitation requires sending specially crafted HTTP requests with malicious Content-Type headers during file upload operations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v10.3.3 or later
Vendor Advisory: https://github.com/nestjs/nest/issues/13311
Restart Required: Yes
Instructions:
1. Update NestJS package to v10.3.3 or later using npm update @nestjs/core. 2. Restart the application server. 3. Verify the update with npm list @nestjs/core.
🔧 Temporary Workarounds
Content-Type Validation Middleware
allImplement middleware to validate and sanitize Content-Type headers before file upload processing
// Example middleware code to validate Content-Type
app.use((req, res, next) => {
const contentType = req.headers['content-type'];
if (contentType && !contentType.includes('multipart/form-data')) {
return res.status(400).send('Invalid Content-Type');
}
next();
});
File Upload Sanitization
allImplement strict file type validation and sanitization for uploaded files
// Example using multer with file filter
const upload = multer({
fileFilter: (req, file, cb) => {
const allowedTypes = ['image/jpeg', 'image/png'];
if (!allowedTypes.includes(file.mimetype)) {
return cb(new Error('Invalid file type'), false);
}
cb(null, true);
}
});
🧯 If You Can't Patch
- Implement WAF rules to block requests with suspicious Content-Type headers
- Disable file upload functionality if not required
🔍 How to Verify
Check if Vulnerable:
Check package.json for @nestjs/core version. If version is 10.3.2 or earlier and application uses file uploads, it's vulnerable.Check Version:
npm list @nestjs/core | grep @nestjs/coreVerify Fix Applied:
Verify @nestjs/core version is 10.3.3 or later using npm list @nestjs/core📡 Detection & Monitoring
Log Indicators:
- HTTP requests with unusual Content-Type headers during file uploads
- Multiple failed file upload attempts with varying Content-Type values
- Error logs showing file processing failures
Network Indicators:
- HTTP POST requests to upload endpoints with non-standard Content-Type headers
- Unusual file upload patterns from single IP addresses
SIEM Query:
source="web_logs" AND (http_method="POST" AND uri_path="*upload*" AND NOT content_type="multipart/form-data")