Crash in HeaderParser in dicer

[TheKingTermux]

Description

This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. A complete denial of service can be achived by sending the malicious form in a loop.

Severity

• Low
• Moderate
• High
• Critical

7.5 / 10

CVSS base metrics

• Attack vector
  Network

• Attack complexity
  Low

• Privileges required
  None

• User interaction
  None

• Scope
  Unchanged

• Confidentiality
  None

• Integrity
  None

• Availability
  High

• CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

• Weaknesses
  CWE-248

• CVE ID
  CVE-2022-24434

• GHSA ID
  GHSA-wm7h-9275-46v2

Information

• Package
  dicer (npm)
• Affected versions
  <= 0.3.1
• Patched version
  None

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-24434
• Security alert: Busboy can crash on manipulated multipart/form-data header names mscdex/busboy#250
• Removed a bug which could cause a crash in HeaderParser, and as consequence could potentially crash a web server based on it mscdex/dicer#22
• mscdex/dicer@b7fca2e
• https://snyk.io/vuln/SNYK-JS-DICER-2311764
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2838865