low2.7

CVE-2024-51999

Withdrawn Advisory: express improperly controls modification of query properties

Impact

## Withdrawn Advisory This advisory has been withdrawn because it describes a correctness bug, not a vulnerability with real security impact. This link is maintained to preserve external references. ## Original Description ### Impact when using the extended query parser in express (`'query parser': 'extended'`), the `request.query` object inherits all object prototype properties, but these properties can be overwritten by query string parameter keys that match the property names > [!IMPORTANT] > the extended query parser is the default in express 4; this was changed in express 5 which by default uses the simple query parser ### Patches the issue has been patched to ensure `request.query` is a plain object so `request.query` no longer has object prototype properties. this brings the default behavior of extended query parsing in line with express's default simple query parser ### Workaround this only impacts users using extended query parsing (`'query parser': 'extended'`), which is the default in express 4, but not express 5. all users are encouraged to upgrade to the patched versions, but can otherwise work around this issue: #### provide `qs` directly and specify `plainObjects: true` ```js app.set('query parser', function (str) { return qs.parse(str, { plainObjects: true }); }); ```

Affected packages

Ecosystem	Package	Affected	Fixed in
npm	`express`	< 4.22.0	4.22.0

Weakness classification

CWE-915

Impact

Affected packages

Weakness classification

References