Listen to this Post
The vulnerability occurs in Express.js versions using the default ‘extended’ query parser. When parsing a query string like ?__proto__
=true</code>, the `qs` library (which handles extended parsing) creates nested objects. The resulting `request.query` object inherits properties from JavaScript's base <code>Object.prototype</code>. Malicious query parameters with keys like <code>__proto__</code>, <code>constructor</code>, or `toString` can overwrite these prototype properties for the application's entire `Object` prototype chain. This pollution affects all objects in the Node.js process, potentially leading to denial-of-service (by breaking application logic that relies on default object methods), information disclosure, or remote code execution in extreme cases if the polluted property influences security checks or file paths. The issue was patched by ensuring `request.query` is a plain object without prototype links.
Platform: Express.js
Version: 4.x
Vulnerability: Prototype Pollution
Severity: Medium
date: 2024
<h2 style="color: blue;">Prediction: 2024-09</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
[bash]
Curl request to test for pollution
curl "http://target.com/?__proto__[bash]=true"
Sample server code vulnerable to CVE-2024-20272
const express = require('express');
const app = express();
app.set('query parser', 'extended');
app.get('/', (req, res) => {
console.log(({}).polluted); // Will log 'true' if polluted
res.send('Check console');
});
Workaround using qs directly with plainObjects
const qs = require('qs');
app.set('query parser', (str) => {
return qs.parse(str, { plainObjects: true });
});
How Exploit:
Attacker sends HTTP request with malicious query string parameters targeting object prototype (e.g., ?__proto__[bash]=payload). This pollutes all objects, potentially crashing the app or altering behavior.
Protection from this CVE:
Upgrade Express.js.
Use 'simple' parser.
Apply workaround: `plainObjects: true`.
Impact:
Denial-of-Service.
Possible Remote Code Execution.
Security Bypass.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
