Listen to this Post
How the CVE Works
form-data uses `Math.random()` to generate boundary values for multipart form data. Since `Math.random()` produces predictable pseudo-random numbers, an attacker observing sequential outputs can determine the PRNG state. By predicting future values (including form-data boundaries), they can craft malicious payloads containing the boundary string. This allows parameter injection/overwrite in multipart requests. The attack requires:
1. Observing `Math.random()` outputs (e.g., via request IDs)
2. Controlling one form-data field
3. Target system processing injected parameters
dailycve form
Platform: Node.js
Version: form-data <4.1.0
Vulnerability: Boundary prediction
Severity: Medium
Date: 2025-07-22
Prediction: Patch by Q3 2025
What Undercode Say
// Vulnerable boundary generation const boundary = '--' + Math.random().toString(36).substr(2)
PoC command to predict boundaries node exploit.js --target http://vulnerable/api
How Exploit
1. Collect `Math.random()` outputs
2. Calculate PRNG state
3. Predict next boundary
4. Craft malicious multipart data
5. Inject parameters via boundary collision
Protection from this CVE
- Update to form-data ≥4.1.0
- Use `crypto.randomBytes()`
– Disable Math.random() side channels
Impact
- Parameter injection
- Request forgery
- Internal system compromise
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
