qs vulnerable to Prototype Pollution
qs before 6.10.3 allows attackers to cause a Node process hang because an `__ proto__` key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as `a[__proto__]=b&a[__proto__]&a[length]=100000000`. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-24999US | high7.5 | Exploit | ||
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be use… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/expressjs/express/releases/tag/4.17.3WEB
- https://github.com/ljharb/qsPACKAGE
- https://github.com/ljharb/qs/commit/4310742efbd8c03f6495f07906b45213da0a32ecWEB
- https://github.com/ljharb/qs/commit/727ef5d34605108acb3513f72d5435972ed15b68WEB
- https://github.com/ljharb/qs/commit/73205259936317b40f447c5cdb71c5b341848e1bWEB
- https://github.com/ljharb/qs/commit/8b4cc14cda94a5c89341b77e5fe435ec6c41be2dWEB
- https://github.com/ljharb/qs/commit/ba24e74dd17931f825adb52f5633e48293b584e1WEB
- https://github.com/ljharb/qs/commit/e799ba57e573a30c14b67c1889c7c04d508b9105WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan