qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).
References
Link | Resource |
---|---|
https://github.com/expressjs/express/releases/tag/4.17.3 | Release Notes |
https://github.com/ljharb/qs/pull/428 | Issue Tracking Patch |
https://github.com/n8tz/CVE-2022-24999 | Exploit Third Party Advisory |
https://lists.debian.org/debian-lts-announce/2023/01/msg00039.html | Mailing List Third Party Advisory |
https://security.netapp.com/advisory/ntap-20230908-0005/ |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2022-11-26T00:00:00
Updated: 2023-09-08T16:06:42.462757
Reserved: 2022-02-14T00:00:00
Link: CVE-2022-24999
JSON object: View
NVD Information
Status : Modified
Published: 2022-11-26T22:15:10.153
Modified: 2023-09-08T17:15:15.687
Link: CVE-2022-24999
JSON object: View
Redhat Information
No data.
CWE