CVE-2024-45590
📋 TL;DR
CVE-2024-45590 is a denial-of-service vulnerability in body-parser middleware for Node.js applications. Attackers can send specially crafted URL-encoded payloads to flood servers with excessive requests, causing resource exhaustion and service disruption. This affects all Node.js applications using vulnerable versions of body-parser with URL encoding enabled.
💻 Affected Systems
- body-parser
📦 What is this software?
Body Parser by Openjsf
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to resource exhaustion, potentially affecting all users and causing extended downtime.
Likely Case
Degraded performance or intermittent service disruptions under targeted attack conditions.
If Mitigated
Minimal impact with proper rate limiting, request validation, and updated middleware.
🎯 Exploit Status
Exploitation requires sending specially crafted URL-encoded payloads but doesn't require authentication or complex attack chains.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.20.3
Vendor Advisory: https://github.com/expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7
Restart Required: Yes
Instructions:
1. Update package.json to specify body-parser version 1.20.3 or higher. 2. Run 'npm update body-parser' or 'yarn upgrade body-parser'. 3. Restart your Node.js application to apply the update.
🔧 Temporary Workarounds
Disable URL encoding
allDisable URL encoding in body-parser configuration if your application doesn't require it.
app.use(bodyParser.urlencoded({ extended: false }));
Implement request rate limiting
allAdd middleware to limit request rates and prevent flooding attacks.
npm install express-rate-limit
const rateLimit = require('express-rate-limit');
app.use(rateLimit({ windowMs: 15 * 60 * 1000, max: 100 }));
🧯 If You Can't Patch
- Implement strict request size limits and validation middleware
- Deploy web application firewall (WAF) with DoS protection rules
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list body-parser' to see installed version. If version is <1.20.3 and URL encoding is enabled, you are vulnerable.Check Version:
npm list body-parser | grep body-parserVerify Fix Applied:
After updating, verify with 'npm list body-parser' shows version 1.20.3 or higher. Test with normal URL-encoded requests to ensure functionality.📡 Detection & Monitoring
Log Indicators:
- Unusually high volume of URL-encoded POST requests
- Increased memory/CPU usage on application servers
- Request timeouts or 503 errors
Network Indicators:
- Spike in incoming traffic to application endpoints
- Repeated similar payload patterns in request bodies
SIEM Query:
source=application_logs ("POST" AND "application/x-www-form-urlencoded") | stats count by src_ip | where count > threshold