CVE-2020-7699— Prototype Pollution
Quick assessment
Affected
n/a express-fileupload
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
express-fileupload是美国Richard Girges软件开发者的一款文件上传中间件。 express-fileupload 1.1.8之前版本中存在安全漏洞。攻击者可借助特制HTTP请求利用该漏洞导致拒绝服务或执行任意代码。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-7699
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Prototype Pollution
Source: CVE Program / CVE List V5
Vulnerability Description
This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
express-fileupload 注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
express-fileupload是美国Richard Girges软件开发者的一款文件上传中间件。 express-fileupload 1.1.8之前版本中存在安全漏洞。攻击者可借助特制HTTP请求利用该漏洞导致拒绝服务或执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | express-fileupload | unspecified ~ 1.1.8 | - |
|
II. Public POCs for CVE-2020-7699
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | 针对 CVE-2020-7699 的复现，软件安全原理课程大作业 | https://github.com/hemaoqi-Tom/CVE-2020-7699_reproduce | POC Details |
| 2 | 针对 CVE-2020-7699 的复现，软件安全原理课程大作业 | https://github.com/zodiac12-pub/CVE-2020-7699_reproduce | POC Details |
AI-Generated POC
Verified env
Premium
Reproduced successfully in a real sandbox
· Below is the actual recording of building the environment and exploiting the vulnerability.
Reproduction recording is a Pro+ exclusive
Watch the full sandbox build + live exploit recording for this CVE. Limited-time ¥499/mo.
Upgrade to Pro+
claude_code
· 5445 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2020-7699
请登录查看更多情报信息。
Vendor Advisories for CVE-2020-7699 (2)
-
https://snyk.io/vuln/SNYK-JS-EXPRESSFILEUPLOAD-595969 x_refsource_MISC
-
https://security.netapp.com/advisory/ntap-20200821-0003/ x_refsource_CONFIRM
Other References for CVE-2020-7699 (1)
-
https://github.com/richardgirges/express-fileupload/issues/236 x_refsource_MISC
Same Patch Batch · n/a · 2020-07-30 · 26 CVEs total
| CVE-2020-10713 | grub2 缓冲区错误漏洞 | |
| CVE-2020-14309 | grub2 输入验证错误漏洞 | |
| CVE-2020-8222 | Pulse Secure Pulse Connect Secure 路径遍历漏洞 | |
| CVE-2020-8221 | Pulse Secure Pulse Connect Secure 路径遍历漏洞 | |
| CVE-2020-8220 | Pulse Secure Pulse Connect Secure 资源管理错误漏洞 | |
| CVE-2020-8219 | Pulse Secure Pulse Connect Secure 安全漏洞 | |
| CVE-2020-8218 | Pulse Secure Pulse Connect Secure 代码注入漏洞 | |
| CVE-2020-8217 | Pulse Secure Pulse Connect Secure 跨站脚本漏洞 | |
| CVE-2020-8216 | Pulse Secure Pulse Connect Secure 信息泄露漏洞 | |
| CVE-2020-8206 | Pulse Secure Pulse Connect Secure 授权问题漏洞 | |
| CVE-2020-8204 | Pulse Secure Pulse Connect Secure 跨站脚本漏洞 | |
| CVE-2020-8202 | Nextcloud Preferred Providers app 安全漏洞 | |
| CVE-2020-8192 | Fastify 资源管理错误漏洞 | |
| CVE-2020-16166 | Linux kernel 安全特征问题漏洞 | |
| CVE-2020-12620 | Pi-hole 安全漏洞 | |
| CVE-2020-14162 | Pi-hole 安全漏洞 | |
| CVE-2020-15957 | DP3T-Backend-SDK 数据伪造问题漏洞 | |
| CVE-2020-14158 | ABUS Secvest FUMO5011 授权问题漏洞 | |
| CVE-2020-15511 | HashiCorp Terraform 输入验证错误漏洞 | |
| CVE-2020-16157 | Nagios Log Server 跨站脚本漏洞 |
Showing top 20 of 26 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: n/a
V. Comments for CVE-2020-7699
No comments yet