Executive brief
qs is a popular Node.js query string parser library used to handle URL parameters in web applications. A flaw in its prototype pollution protection allows attackers to bypass safeguards and modify core JavaScript object properties, potentially causing application denial of service or, in specific configurations, remote code execution.
Technical details
The vulnerability is a prototype pollution protection bypass in the qs.parse() function (CWE-20: Improper Input Validation). When parsing query strings containing bracket characters ('[' or ']'), the parser fails to properly prevent modification of Object.prototype despite having prototype pollution defenses in place. An attacker can supply crafted input (e.g., "[=toString") to an application that uses qs to parse untrusted query parameters, bypassing the allowPrototypes: false protection. This enables modification of properties inherited by all objects, potentially leading to denial of service or remote code execution depending on application context and usage patterns. Patches are available in versions 6.0.4, 6.1.2, 6.2.3, 6.3.2, and later.
Affected products
- npm qs before 6.0.4, 6.1.0 before 6.1.2, 6.2.0 before 6.2.3, 6.3.0 before 6.3.2
Timeline
- 2020-04-30: disclosed
- other: CVE-2017-1000048 assigned to related prototype pollution bypass issue