CVE-2022-24999
CVE-2022-24999
In short
A flaw in the qs library allows attackers to hang Node.js applications by sending specially crafted queries that exploit the __proto__ property. An unauthenticated attacker can trigger this remotely through a simple URL query string, causing the server to become unresponsive.
Technical detail
The qs query parser fails to properly sanitize __proto__ keys during object merging, enabling prototype pollution that causes excessive memory allocation and CPU consumption. An unauthenticated remote attacker can craft a GET request with nested __proto__ assignments and large length values to induce denial of service in Express applications.
Summary generated and translated by AI from the official description.
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
n/a · n/aWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →