qs vulnerable to Prototype Pollution
qs before 6.10.3 allows attackers to cause a Node process hang because an `__ proto__` key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as `a[__proto__]=b&a[__proto__]&a[length]=100000000`. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-24999US | high7.5 | Exploit | ||
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be use… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/expressjs/express/releases/tag/4.17.3WEB
- https://github.com/ljharb/qsPACKAGE
- https://github.com/ljharb/qs/commit/4310742efbd8c03f6495f07906b45213da0a32ecWEB
- https://github.com/ljharb/qs/commit/727ef5d34605108acb3513f72d5435972ed15b68WEB
- https://github.com/ljharb/qs/commit/73205259936317b40f447c5cdb71c5b341848e1bWEB
- https://github.com/ljharb/qs/commit/8b4cc14cda94a5c89341b77e5fe435ec6c41be2dWEB
- https://github.com/ljharb/qs/commit/ba24e74dd17931f825adb52f5633e48293b584e1WEB
- https://github.com/ljharb/qs/commit/e799ba57e573a30c14b67c1889c7c04d508b9105WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan