Executive brief
querystringify is a JavaScript library that parses query strings into objects. A flaw allows attackers to inject malicious query parameters that override built-in JavaScript object properties (like toString), potentially breaking application logic and enabling code execution in vulnerable downstream consumers.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in querystringify versions before 2.0.0. When parsing a query string, the library directly assigns parsed key-value pairs to an object without validating property names, allowing special constructor and built-in properties like "toString" or "__proto__" to be overwritten. An attacker can craft a malicious URL query string (e.g., "?toString&") to pollute the prototype. This requires only network reachability and a vulnerable application that passes untrusted query strings to the library. The fix, released in version 2.0.0, prevents assignment to built-in and previously-set properties during parsing.
Affected products
- unshiftio querystringify before 2.0.0
Timeline
- 2019-06-07: disclosed
- 2018-04-19: patched: Fix merged in PR #19 in April 2018, advisory published in June 2019