Vulnerability Description
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Qs Project | Qs | < 6.2.4 |
| Openjsf | Express | < 4.17.3 |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- https://github.com/expressjs/express/releases/tag/4.17.3Release Notes
- https://github.com/ljharb/qs/pull/428Issue TrackingPatch
- https://github.com/n8tz/CVE-2022-24999ExploitThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00039.htmlMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20230908-0005/
- https://github.com/expressjs/express/releases/tag/4.17.3Release Notes
- https://github.com/ljharb/qs/pull/428Issue TrackingPatch
- https://github.com/n8tz/CVE-2022-24999ExploitThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00039.htmlMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20230908-0005/
FAQ
What is CVE-2022-24999?
CVE-2022-24999 is a vulnerability with a CVSS score of 7.5 (HIGH). qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical E...
How severe is CVE-2022-24999?
CVE-2022-24999 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-24999?
Check the references section above for vendor advisories and patch information. Affected products include: Qs Project Qs, Openjsf Express, Debian Debian Linux.