Executive brief
querymen is a query-string parser middleware for Node.js/Express applications. A prototype pollution vulnerability allows attackers to inject malicious properties into JavaScript object prototypes if the handler function's parameters are controlled by users without validation. This can lead to denial of service, application crashes, or in severe cases, remote code execution depending on how the application uses object properties.
Technical details
The vulnerability is a prototype pollution flaw in the querymen package's handler(type, name, fn) function that allows attackers to pollute the Object.prototype by injecting properties via the __proto__, constructor, or prototype attributes. The root cause is incomplete sanitization of function parameters—specifically, if user-controlled input reaches the handler function without validation, an attacker can exploit unsafe property assignment patterns. The attack vector is network-based and requires no authentication or user interaction. An attacker can trigger denial of service by corrupting inherited properties that the application depends on (e.g., toString, valueOf), or in more sophisticated scenarios, achieve remote code execution if the application evaluates polluted properties. This vulnerability is an incomplete fix for CVE-2020-7600 and affects querymen versions up to 2.1.4 with no patched version available.
Affected products
- npm querymen up to 2.1.4
Timeline
- 2022-02-02: disclosed
- 2022-06-18: advisory