CVE-2020-7699 Prototype Pollution
Attackers can achieve arbitrary code execution or denial of service via prototype pollution in express-fileupload when parseNested is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-7699?
CVE-2020-7699 is a high-severity code injection vulnerability in express-fileupload, published on 30 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.
Weakness: CWE-1321
Which versions are affected by CVE-2020-7699?
2 open source packages ship an affected version, including express-fileupload. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
express-fileupload npm | All versions | 1.1.9 |
express-fileupload npm | All versions | 1.1.9 |
Products include Express-Fileupload Project Express-Fileupload, Netapp Max Data.
How do I fix CVE-2020-7699?
Upgrade express-fileupload to 1.1.9 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-7699 being exploited?
There is no known exploitation of CVE-2020-7699 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in express-fileupload
Sources
Also known as GHSA-9wcg-jrwf-8gg7, SNYK-JS-EXPRESSFILEUPLOAD-595969.