Fix CVE-2022-24434

[JanStorm]

Description

This application is vulnerable to CVE-2022-24434. This means, each api endpoint which handles image uploads can be used to shut down the nodejs-server.
This issues comes in through the package multer, which uses another package called dicer, in which the vulnerability was found. The newest version of multer (1.4.5-lts.1) now includes a fix for this vulnerability (see expressjs/multer#1097).

Exploit example

As a demo, we use the /rest/memories endpoint to send the invalid payload

fetch('/rest/memories', {
   method: 'POST',
   headers: {
     ['content-type']: 'multipart/form-data; boundary=----WebKitFormBoundaryoo6vortfDzBsDiro',
     ['content-length']: '145',
   },
   body: '------WebKitFormBoundaryoo6vortfDzBsDiro\r\n Content-Disposition: form-data; name="bildbeschreibung"\r\n\r\n\r\n------WebKitFormBoundaryoo6vortfDzBsDiro--'
 });

The result of this is the nodejs-server crashing.

Resolved or fixed issue: none

Affirmation

• My code follows the CONTRIBUTING.md guidelines