CVE-2022-24999 @ Npm-qs-6.0.0

[apcxtest]

Vulnerable Package issue exists @ Npm-qs-6.0.0 in branch main

The qs package as used in Express through 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an "__ proto__ key" can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as "a[proto]=b&a[proto]&a[length]=100000000". This vulnerability affects qs versions through 6.2.3, 6.3.0 through 6.3.2, 6.4.0, 6.5.0 through 6.5.2, 6.6.0, 6.7.0 through 6.7.2, 6.8.0 through 6.8.2, 6.9.0 through 6.9.6 and 6.10.0 through 6.10.2 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).

Namespace: apcxtest
Repository: test-repo-pub
Repository Url: https://github.com/apcxtest/test-repo-pub
CxAST-Project: apcxtest/test-repo-pub
CxAST platform scan: a314b9e1-0b75-4c05-86f0-fa4203a6e7fd
Branch: main
Application: test-repo-pub
Severity: HIGH
State: TO_VERIFY
Status: RECURRENT
CWE: CWE-1321

---

Additional Info
Attack vector: NETWORK
Attack complexity: LOW
Confidentiality impact: NONE
Availability impact: HIGH
Remediation Upgrade Recommendation: 6.2.4

---

References
Advisory
Disclosure
Release Note
Pull request
Commit