Skip to content

Latest commit

 

History

History
79 lines (68 loc) · 5.37 KB

mitigations.md

File metadata and controls

79 lines (68 loc) · 5.37 KB

Mitigation Strategies Analysis for expressjs/body-parser

Mitigation Strategy: Limit Request Body Size

  • Description:
    1. Determine the maximum acceptable size for request bodies for your application.
    2. For each body-parser middleware instance (bodyParser.json(), bodyParser.urlencoded(), bodyParser.raw(), bodyParser.text()), configure the limit option.
    3. Set the limit value to the determined maximum size (e.g., '100kb', '1mb').
    4. Apply this configuration to all relevant routes or middleware stacks.
    5. Test to ensure requests exceeding the limit are rejected with a 413 error.
  • Threats Mitigated:
    • Denial of Service (DoS) - High Severity: Prevents resource exhaustion from excessively large request bodies.
  • Impact:
    • DoS Mitigation - High Impact: Significantly reduces DoS risk from oversized payloads.
  • Currently Implemented: No - Project Specific - Needs Assessment.
  • Missing Implementation: Project Wide - Needs Assessment.

Mitigation Strategy: Control Parameter Count and Depth

  • Description:
    1. Analyze expected data structures for URL-encoded and JSON requests to determine reasonable limits for parameter count and nesting depth.
    2. For bodyParser.urlencoded() and bodyParser.json(), configure the parameterLimit and depth options.
    3. Set parameterLimit to restrict the number of parameters.
    4. Set depth to limit the nesting level of objects.
    5. Apply these configurations where these parsers are used.
    6. Test to confirm requests exceeding these limits are handled appropriately (e.g., 400 error).
  • Threats Mitigated:
    • Denial of Service (DoS) - Medium to High Severity: Prevents CPU exhaustion from parsing overly complex request bodies with many parameters or deep nesting.
  • Impact:
    • DoS Mitigation - Medium to High Impact: Reduces DoS risk from complex data structures.
  • Currently Implemented: No - Project Specific - Needs Assessment.
  • Missing Implementation: Project Wide - Needs Assessment.

Mitigation Strategy: Use extended: false for urlencoded Parsing when possible

  • Description:
    1. Evaluate if extended urlencoded parsing (using qs library) is necessary for your application.
    2. If not, configure bodyParser.urlencoded({ extended: false }) to use the built-in querystring library.
    3. If extended parsing is needed, ensure other mitigations (like parameter and depth limits) are robust.
    4. Test application functionality after switching to extended: false.
  • Threats Mitigated:
    • Denial of Service (DoS) - Low to Medium Severity: Reduces potential attack surface and performance issues associated with the more complex qs library.
    • Parameter Pollution - Low Severity: Slightly reduces risk related to complex parsing edge cases.
  • Impact:
    • DoS Mitigation - Low to Medium Impact: Marginally reduces DoS risk by using a simpler parser.
    • Parameter Pollution Mitigation - Low Impact: Slightly reduces parameter pollution risks.
  • Currently Implemented: No - Project Specific - Needs Assessment.
  • Missing Implementation: Project Wide - Needs Assessment.

Mitigation Strategy: Explicitly Configure body-parser Settings

  • Description:
    1. Review all body-parser middleware instances in the application.
    2. Ensure options like limit, parameterLimit, and depth are explicitly set with appropriate values.
    3. Avoid using body-parser without any configuration, as defaults may be insecure.
    4. Document chosen configurations and their rationale.
  • Threats Mitigated:
    • Security Misconfiguration - Medium Severity: Prevents unintentionally permissive settings due to reliance on defaults.
  • Impact:
    • Security Misconfiguration Mitigation - Medium Impact: Reduces risk of misconfiguration by enforcing explicit settings.
  • Currently Implemented: No - Project Specific - Needs Assessment.
  • Missing Implementation: Project Wide - Needs Assessment.

Mitigation Strategy: Use Strict JSON Parsing (strict: true)

  • Description:
    1. For bodyParser.json(), configure the strict: true option.
    2. This enforces stricter JSON parsing according to RFC 7159, rejecting invalid JSON syntax.
    3. Test application functionality with strict parsing enabled.
    4. Handle potential parsing errors (e.g., 400 error) gracefully.
  • Threats Mitigated:
    • Data Integrity - Low Severity: Ensures only valid JSON is processed, improving data integrity.
    • Security Misconfiguration - Very Low Severity: Reduces potential for unexpected behavior from lenient parsing.
  • Impact:
    • Data Integrity Improvement - Low Impact: Slightly improves data integrity by enforcing JSON validity.
    • Security Misconfiguration Mitigation - Very Low Impact: Marginally reduces risks from lenient parsing.
  • Currently Implemented: No - Project Specific - Needs Assessment.
  • Missing Implementation: Project Wide - Needs Assessment.