CVE-2022-24999
Description
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).
How to fix
- openjsf express4.17.3 or later
- qs_project qs6.2.4, 6.3.3, 6.5.3, 6.7.3, 6.8.3, 6.9.7, 6.10.3 or later
- qs6.10.3, 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, 6.2.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openjsf express | v < 4.17.3 | 4.17.3 |
| qs_project qs | v < 6.2.4, 6.3.0 ≤ v < 6.3.3, 6.5.0 ≤ v < 6.5.3, 6.7.0 ≤ v < 6.7.3, 6.8.0 ≤ v < 6.8.3, 6.9.0 ≤ v < 6.9.7, 6.10.0 ≤ v < 6.10.3, 6.4.0, 6.6.0 | 6.2.4, 6.3.3, 6.5.3, 6.7.3, 6.8.3, 6.9.7, 6.10.3 |
| debian debian_linux | 10.0 | — |
| qsnpm | 6.10.0 ≤ v < 6.10.3, 6.9.0 ≤ v < 6.9.7, 6.8.0 ≤ v < 6.8.3, 6.7.0 ≤ v < 6.7.3, 6.6.0 ≤ v < 6.6.1, 6.5.0 ≤ v < 6.5.3, 6.4.0 ≤ v < 6.4.1, 6.3.0 ≤ v < 6.3.3, v < 6.2.4 | 6.10.3, 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, 6.2.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.