qs vulnerable to Prototype Pollution

[TheKingTermux]

Description

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).

Severity Check

• Low
• Moderate
• High
• Critical

Severity Number

7.5

CVSS base metrics

• Attack vector
  Network

• Attack complexity
  Low

• Privileges required
  None

• User interaction
  None

• Scope
  Unchanged

• Confidentiality
  None

• Integrity
  None

• Availability
  High

• CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

• Weaknesses
  CWE-1321

• CVE ID
  CVE-2022-24999

• GHSA ID
  GHSA-hrpp-h998-j3pp

Information

Package

• express (npm)
  Affected versions Patched versions
  < 4.17.3 4.17.3

• qs (npm)
  Affected versions Patched versions

= 6.10.0, < 6.10.3 6.10.3
= 6.9.0, < 6.9.7 6.9.7
= 6.8.0, < 6.8.3 6.8.3
= 6.7.0, < 6.7.3 6.7.3
= 6.6.0, < 6.6.1 6.6.1
= 6.5.0, < 6.5.3 6.5.3
= 6.4.0, < 6.4.1 6.4.1
= 6.3.0, < 6.3.3 6.3.3
< 6.2.4 6.2.4

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-24999

• [Fix] parse: ignore __proto__ keys ljharb/qs#428

• https://github.com/expressjs/express/releases/tag/4.17.3

• https://github.com/n8tz/CVE-2022-24999

[TheKingTermux]

/lock