Listen to this Post
The qs library, a Node.js query string parser, includes an arrayLimit option designed to prevent denial-of-service by restricting array sizes during parsing. However, this protection is only enforced for indexed array notation (e.g., a
=1&a[bash]=2). For bracket notation (e.g., a[]=1&a[]=2), the arrayLimit check is completely bypassed. In the source code (lib/parse.js), lines 159-162 handle bracket notation by calling utils.combine([], leaf) without validating against options.arrayLimit. In contrast, lines 175 for indexed notation correctly check index <= options.arrayLimit before creating arrays. This inconsistency allows attackers to send query strings with unlimited bracket notation parameters. When parsed, qs ignores the arrayLimit and allocates memory for all elements, leading to memory exhaustion. Applications using qs.parse() on user-controlled input with arrayLimit set are vulnerable. Attackers can craft HTTP requests with thousands of bracket notation parameters (e.g., filters[]=x repeated) to trigger uncontrolled memory allocation, crashing the server or making it unresponsive, resulting in denial-of-service.
Platform: qs
Version: prior to fix
Vulnerability: Array limit bypass
Severity: Critical
date: not provided
<h2 style="color: blue;">Prediction: patch expected soon</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
[bash]
node -e "const qs=require('qs');const r=qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6',{arrayLimit:5});console.log(r.a.length);"
node -e "const qs=require('qs');const a='a[]='+Array(10000).fill('x').join('&a[]=');const r=qs.parse(a,{arrayLimit:100});console.log(r.a.length);"
How Exploit:
Craft HTTP requests with repeated bracket notation parameters (e.g., GET /api/search?filters[]=x&filters[]=x…). Use tools like curl or automated scripts to send malicious queries to endpoints parsing input with qs.parse() and arrayLimit set.
Protection from this CVE
Update qs to patched version. Implement input validation and rate limiting. Use alternative parsing libraries without this flaw.
Impact:
Denial-of-service via memory exhaustion. Single request can crash server. No authentication required. Affects all endpoints using vulnerable qs.parse().
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
