Multer Denial-of-Service Vulnerability via Unhandled Exception

A denial-of-service vulnerability has been identified in Multer, a Node.js middleware for handling multipart/form-data. This issue affects Multer versions 1.4.4-lts.1 through 2.0.1. The vulnerability allows an attacker to cause a process crash by sending an upload file request with an empty string as the field name. This request triggers an unhandled exception, leading to the process's termination.

Impact

Exploitation of this vulnerability causes the process to crash, leading to a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by sending a file upload request through the 'FilesInterceptor' of Nest.js, which uses Multer internally. The request must include an empty string as the field name. This can be done by default, as the Busboy library, which Multer relies on, emits an undefined value for the field name when it's not set, causing a TypeError in the process.

Remediation

Users are advised to upgrade to Multer version 2.0.1, where this vulnerability has been patched.