GitHub Advisoryadvisory · npm

GHSA-gqgv-6jq5-jjj9 Prototype Pollution Protection Bypass in qs

HIGH Published 2020-04-30 Modified 2021-08-25 Official page ↗
Aliases
CVE-2017-1000048
Ecosystem
npm
Packages
qs
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-20
Reviewed
2020-04-30

Affected packages

• npm qs: < 6.0.4 → fixed in 6.0.4 • npm qs: >= 6.1.0, < 6.1.2 → fixed in 6.1.2 • npm qs: >= 6.2.0, < 6.2.3 → fixed in 6.2.3 • npm qs: >= 6.3.0, < 6.3.2 → fixed in 6.3.2

Description

Affected version of `qs` are vulnerable to Prototype Pollution because it is possible to bypass the protection. The `qs.parse` function fails to properly prevent an object's prototype to be altered when parsing arbitrary input. Input containing `[` or `]` may bypass the prototype pollution protection and alter the Object prototype. This allows attackers to override properties that will exist in all objects, which may lead to Denial of Service or Remote Code Execution in specific circumstances. Recommendation Upgrade to 6.0.4, 6.1.2, 6.2.3, 6.3.2 or later.

Related

Alias · CVE (1)

  • CVE-2017-1000048 the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References