CVE Vulnerabilities

CVE-2022-24999

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Published: Nov 26, 2022 | Modified: Apr 29, 2025
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
7.5 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
MEDIUM

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has deps: qs@6.9.7 in its release description, is not vulnerable).

Weakness

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Affected Software

Name Vendor Start Version End Version
Qs Qs_project * 6.2.4 (excluding)
Qs Qs_project 6.3.0 (including) 6.3.3 (excluding)
Qs Qs_project 6.5.0 (including) 6.5.3 (excluding)
Qs Qs_project 6.7.0 (including) 6.7.3 (excluding)
Qs Qs_project 6.8.0 (including) 6.8.3 (excluding)
Qs Qs_project 6.9.0 (including) 6.9.7 (excluding)
Qs Qs_project 6.10.0 (including) 6.10.3 (excluding)
Qs Qs_project 6.4.0 (including) 6.4.0 (including)
Qs Qs_project 6.6.0 (including) 6.6.0 (including)
MTA-6.0-RHEL-8 RedHat mta/mta-ui-rhel8:6.0.1-10 *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat acm-governance-policy-addon-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat acm-grafana-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat acm-must-gather-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat acm-operator-bundle-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat acm-prometheus-config-reloader-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat acm-prometheus-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat acm-volsync-addon-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat cert-policy-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat cluster-backup-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat config-policy-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat console-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat endpoint-monitoring-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat governance-policy-propagator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat governance-policy-spec-sync-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat governance-policy-status-sync-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat governance-policy-template-sync-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat grafana-dashboard-loader-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat iam-policy-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat insights-client-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat insights-metrics-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat klusterlet-addon-controller-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat kube-rbac-proxy-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat kube-state-metrics-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat management-ingress-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat memcached-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat memcached-exporter-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat metrics-collector-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicloud-integrations-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multiclusterhub-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multiclusterhub-repo-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-observability-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-operators-application-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-operators-channel-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat multicluster-operators-subscription-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat node-exporter-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat observatorium-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat observatorium-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat prometheus-alertmanager-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat prometheus-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat rbac-query-proxy-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat redisgraph-tls-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat search-aggregator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat search-api-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat search-collector-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat search-operator-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat submariner-addon-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat thanos-container *
Red Hat Advanced Cluster Management for Kubernetes 2 RedHat thanos-receive-controller-container *
Red Hat Enterprise Linux 8 RedHat nodejs:14-8070020221212161539.bd1311ed *
Red Hat Enterprise Linux 8.4 Extended Update Support RedHat nodejs:14-8040020230306170312.522a0ee4 *
Red Hat Enterprise Linux 8.6 Extended Update Support RedHat nodejs:14-8060020230306170237.ad008a3a *
Red Hat Migration Toolkit for Containers 1.7 RedHat rhmtc/openshift-migration-ui-rhel8:v1.7.8-5 *
Red Hat OpenShift Service Mesh 2.2 for RHEL 8 RedHat openshift-service-mesh/prometheus-rhel8:2.2.7-7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat rh-nodejs14-nodejs-0:14.21.1-3.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat rh-nodejs14-nodejs-nodemon-0:2.0.20-2.el7 *
RHODF-4.12-RHEL-8 RedHat odf4/mcg-core-rhel8:v4.12.3-4 *
RHOL-5.5-RHEL-8 RedHat openshift-logging/logging-view-plugin-rhel8:v5.5.8-3 *
RHOL-5.6-RHEL-8 RedHat openshift-logging/logging-view-plugin-rhel8:v5.6.3-5 *
Node-express Ubuntu bionic *
Node-express Ubuntu esm-apps/focal *
Node-express Ubuntu focal *
Node-express Ubuntu kinetic *
Node-express Ubuntu lunar *
Node-express Ubuntu mantic *
Node-express Ubuntu trusty *
Node-express Ubuntu xenial *
Node-qs Ubuntu esm-apps/focal *

Potential Mitigations

References