CVE-2022-24999

Published Nov 26, 2022

Last updated a year ago

CVSS high 7.5

Overview

Description: qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).
Source: cve@mitre.org
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-1321

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:qs_project:qs:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F7960844-79EB-454C-BD4C-C79387E2E573",
            "versionEndExcluding": "6.2.4"
          },
          {
            "criteria": "cpe:2.3:a:qs_project:qs:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B836471B-BF39-4B52-B837-70B494D2C45F",
            "versionEndExcluding": "6.3.3",
            "versionStartIncluding": "6.3.0"
          },
          {
            "criteria": "cpe:2.3:a:qs_project:qs:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DF319EA6-E68F-41A8-BB21-FE30F6BD1A9C",
            "versionEndExcluding": "6.5.3",
            "versionStartIncluding": "6.5.0"
          },
          {
            "criteria": "cpe:2.3:a:qs_project:qs:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E43C2419-E3F8-4123-8FA8-A0C1B4244D77",
            "versionEndExcluding": "6.7.3",
            "versionStartIncluding": "6.7.0"
          },
          {
            "criteria": "cpe:2.3:a:qs_project:qs:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BB20DBEF-67E2-49FB-BB55-C86F7A83028F",
            "versionEndExcluding": "6.8.3",
            "versionStartIncluding": "6.8.0"
          },
          {
            "criteria": "cpe:2.3:a:qs_project:qs:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "49C25B47-56FD-43BF-9DA4-A6100DD291EE",
            "versionEndExcluding": "6.9.7",
            "versionStartIncluding": "6.9.0"
          },
          {
            "criteria": "cpe:2.3:a:qs_project:qs:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "750DDAB9-4454-4087-8DA1-D05280F59081",
            "versionEndExcluding": "6.10.3",
            "versionStartIncluding": "6.10.0"
          },
          {
            "criteria": "cpe:2.3:a:qs_project:qs:6.4.0:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "535F43BA-C0A4-441A-A13C-A221ED855613"
          },
          {
            "criteria": "cpe:2.3:a:qs_project:qs:6.6.0:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "870A2680-00C2-43D2-9C4B-D8F52DB16AA1"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:openjsf:express:*:*:*:*:*:node.js:*:*",
            "vulnerable": true,
            "matchCriteriaId": "31382A93-AA97-4D14-ACF6-129F1BDDFD6D",
            "versionEndExcluding": "4.17.3"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

References