Описание
Withdrawn Advisory: express improperly controls modification of query properties
Withdrawn Advisory
This advisory has been withdrawn because it describes a correctness bug, not a vulnerability with real security impact. This link is maintained to preserve external references.
Original Description
Impact
when using the extended query parser in express ('query parser': 'extended'), the request.query object inherits all object prototype properties, but these properties can be overwritten by query string parameter keys that match the property names
[!IMPORTANT]
the extended query parser is the default in express 4; this was changed in express 5 which by default uses the simple query parser
Patches
the issue has been patched to ensure request.query is a plain object so request.query no longer has object prototype properties. this brings the default behavior of extended query parsing in line with express's default simple query parser
Workaround
this only impacts users using extended query parsing ('query parser': 'extended'), which is the default in express 4, but not express 5. all users are encouraged to upgrade to the patched versions, but can otherwise work around this issue:
provide qs directly and specify plainObjects: true
Ссылки
- https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6
- https://nvd.nist.gov/vuln/detail/CVE-2024-51999
- https://github.com/expressjs/express/commit/2f64f68c37c64ae333e41ff38032d21860f22255
- https://github.com/expressjs/express/releases/tag/4.22.0
- https://github.com/expressjs/express/releases/tag/v5.2.0
Пакеты
express
< 4.22.0
4.22.0
express
>= 5.0.0, < 5.2.0
5.2.0
Связанные уязвимости
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error and is not a valid vulnerability. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.