Description

Detects Express.js routes that accept requests without proper MIME type validation. When Express accepts any MIME type, attackers can send malicious content using unexpected content-types, potentially leading to request smuggling or server-side processing attacks.

Detection Strategy

• Identifies Express.js route handlers and middleware configurations in the codebase

• Checks if route configurations lack proper content-type restrictions or use unsafe MIME type acceptance

• Reports vulnerability when routes accept all MIME types or have overly permissive content-type settings

Vulnerable code example

const express = require('express')
const bodyParser = require('body-parser')

const app = express()

app.use(bodyParser.text({ type: '*/*' })) // Vulnerable: Accepts ANY content-type, enabling content-type confusion attacks
app.use(bodyParser.json())
...

✅ Secure code example

const express = require('express')
const bodyParser = require('body-parser')

const app = express()

// Only parse text/plain content type to prevent content-type confusion
app.use(bodyParser.text({ type: 'text/plain' }))
...