Loading vulnerability…
CVE-2024-45590 is an uncontrolled resource-consumption vulnerability in body-parser versions earlier than 1.20.3. Applications that enable URL-encoded request-body parsing can be subjected to denial of service using specially crafted URL-encoded payloads and a large volume of requests, exhausting server resources and impairing request processing.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
Repository is a self-contained Dockerized PoC for CVE-2024-45590 described as an unauthenticated RCE via arbitrary file upload in a WordPress plugin. Structure/purpose: - src/scanner.py: Main Python PoC “scanner” that (1) checks the target looks like WordPress, (2) checks for the presence of a specific plugin path, (3) exploits an upload endpoint to place PHP files, and (4) confirms RCE by requesting the uploaded PHP and observing output. - vulnerable/: Builds a WordPress 6.5 + Apache container and installs an intentionally vulnerable plugin under wp-content/plugins/vulnerable-plugin. - vulnerable-plugin/upload.php: A direct upload handler that moves any uploaded file into a web-accessible uploads/ directory with no type validation (core vulnerability used by the PoC). - vulnerable-plugin/vulnerable-plugin.php: WordPress plugin code that also registers an unauthenticated admin-post upload action (nopriv) and moves uploaded files without validation (demonstrates the same class of issue). - docker-compose.yml: Spins up the vulnerable WordPress + MySQL and a scanner container on a fixed 192.168.1.0/24 bridge network; exposes WordPress on host port 8080. - results/result.json: Example output showing {ip, vuln}. Exploit capabilities (what it actually does): - Network-based exploitation over HTTP using requests.Session. - Uploads PHP payloads (e.g., test_id.php and test_ping.php) to /wp-content/plugins/vulnerable-plugin/upload.php. - Confirms code execution by fetching the uploaded PHP and checking for `uid=` (from `id`) and ping output (from `ping -c 1 127.0.0.1`). - Records a boolean vulnerable/not vulnerable result to /app/results/result.json. Notable implementation detail: - scanner.py contains an execute_command() helper that sends a `cmd` query parameter, but the uploaded test payloads do not read $_GET['cmd']; instead they execute hardcoded commands. So the PoC is primarily a safe verification workflow rather than an interactive command shell.
This repository contains a single Python script (CVE-2024-45590.py) that serves as a proof-of-concept exploit for CVE-2024-45590. The script targets a web API endpoint (default: https://test.com/api/) by sending POST requests with extremely deeply nested JSON and form-encoded payloads, as well as large strings and array bombs. The goal is to trigger resource exhaustion or stack overflow on the server, resulting in a denial of service (DoS). The script is configurable for payload depth and can be adapted to target different endpoints. It is a standalone PoC, not part of any exploit framework, and is intended to demonstrate the vulnerability rather than provide a weaponized attack. The code is well-structured, with separate functions for building different types of payloads and a main function that sends the payloads and prints the server's response.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Denial-of-service vulnerability in the body-parser library addressed by the Network Observability 1.7.0 update.
A denial-of-service vulnerability in the body-parser package.
A denial-of-service vulnerability in the body-parser package.
A denial-of-service vulnerability in body-parser.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.