Executive brief
querymen is a software library used to parse web request queries for Node.js applications and MongoDB databases. A security flaw in this library allows an attacker to modify the internal properties of the application's data structures. This can lead to unexpected application behavior, potential data corruption, or service disruptions.
Technical details
A prototype pollution vulnerability exists in querymen versions prior to 2.1.4. The vulnerability is located in the exported 'handler(type, name, fn)' function, where user-controlled parameters are processed without sufficient sanitization. An attacker can exploit this by passing malicious strings such as '__proto__' as the 'type' argument, allowing them to modify the global Object prototype. This can result in the modification of application logic or, in some environments, lead to denial of service or remote code execution depending on how the polluted properties are used by the application. The issue is fixed in version 2.1.4.
Affected products
- diegohaz querymen < 2.1.4
Timeline
- 2020-03-12: disclosed: Vulnerability disclosed and Snyk ID published.
- 2020-03-12: advisory: NVD published the CVE record.
- 2020-03-12: patched: Fix committed in GitHub repository.
- 2021-05-07: advisory: GitHub Advisory published.