Executive brief
qs is a popular JavaScript library used to parse URL query strings in web applications. An attacker can exploit prototype pollution through crafted query parameters to cause a Node.js process to hang indefinitely, resulting in denial of service. This vulnerability affects any web application using vulnerable qs versions without authentication requirements.
Technical details
qs is vulnerable to prototype pollution via the `__proto__` key in parsed query strings. An unauthenticated remote attacker can inject a malicious payload such as `a[__proto__]=b&a[__proto__]&a[length]=100000000` into URL query parameters to trigger unbounded object property assignment. The vulnerability allows attackers to pollute the JavaScript object prototype, causing a Node.js process to hang indefinitely by exhausting memory or CPU resources. The fix involves filtering out `__proto__` keys during query string parsing; patches are available in qs 6.2.4, 6.3.3, 6.4.1, 6.5.3, 6.6.1, 6.7.3, 6.8.3, 6.9.7, and 6.10.3.
Affected products
- npm qs before 6.2.4, 6.3.x before 6.3.3, 6.4.x before 6.4.1, 6.5.x before 6.5.3, 6.6.x before 6.6.1, 6.7.x before 6.7.3, 6.8.x before 6.8.3, 6.9.x before 6.9.7, 6.10.x before 6.10.3
Timeline
- 2022-11-27: disclosed
- 2022-11-27: patched: Patches released for multiple version branches