PT-2022-17038 · Qs+8 · Qs+8
Johan Brissaud
+1
·
Published
2022-11-26
·
Updated
2026-02-04
·
CVE-2022-24999
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
qs versions prior to 6.10.3
Express versions prior to 4.17.3
Description
The issue allows attackers to cause a Node process hang for an Express application because an
proto key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[ proto ]=b&a[ proto ]&a[length]=100000000.Recommendations
For qs versions prior to 6.10.3, update to qs 6.10.3 or later.
For Express versions prior to 4.17.3, update to Express 4.17.3 or later, which includes the fixed qs version.
As a temporary workaround, consider restricting access to the query string parameter
a[ proto ] and a[length] to minimize the risk of exploitation.Exploit
Fix
Prototype Pollution
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Express
Linuxmint
Red Hat
Rocky Linux
Ubuntu
Qs