qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express applicat
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.10.3, 6.9.7, 6.8.3, 6.7.3, 6.6.1, and 4 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
- Exploitation: poc
- Automatable: yes
- Technical impact: partial
Summary
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: partial
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a n/a
Version range not reported
- qsnpm
From 6.10.0 · fixed in 6.10.3
- qsnpm
From 6.9.0 · fixed in 6.9.7
- qsnpm
From 6.8.0 · fixed in 6.8.3
- qsnpm
From 6.7.0 · fixed in 6.7.3
- qsnpm
From 6.6.0 · fixed in 6.6.1
- qsnpm
From 6.5.0 · fixed in 6.5.3
- qsnpm
From 6.4.0 · fixed in 6.4.1
- qsnpm
From 6.3.0 · fixed in 6.3.3
- qsnpm
fixed in 6.2.4