CVE-2024-51999

描述

## Withdrawn Advisory This advisory has been withdrawn because it describes a correctness bug, not a vulnerability with real security impact. This link is maintained to preserve external references. ## Original Description ### Impact when using the extended query parser in express (`'query parser': 'extended'`), the `request.query` object inherits all object prototype properties, but these properties can be overwritten by query string parameter keys that match the property names > [!IMPORTANT] > the extended query parser is the default in express 4; this was changed in express 5 which by default uses the simple query parser ### Patches the issue has been patched to ensure `request.query` is a plain object so `request.query` no longer has object prototype properties. this brings the default behavior of extended query parsing in line with express's default simple query parser ### Workaround this only impacts users using extended query parsing (`'query parser': 'extended'`), which is the default in express 4, but not express 5. all users are encouraged to upgrade to the patched versions, but can otherwise work around this issue: #### provide `qs` directly and specify `plainObjects: true` ```js app.set('query parser', function (str) { return qs.parse(str, { plainObjects: true }); }); ```

如何修補 CVE-2024-51999

要修補 CVE-2024-51999,請將受影響套件升級到下列已修補版本。

• —升級至 4.22.0 或更新版本

CVE-2024-51999 正在被利用嗎?

目前沒有被利用訊號。CVE-2024-51999 既不在 CISA KEV 也沒有最新的 EPSS 分數。

受影響套件(1)

• from 0, < 4.22.0

CVSS 分數

參考連結(6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-51999
• PATCHgithub.com/expressjs/express
• WEBgithub.com/expressjs/express/commit/2f64f68c37c64ae333e41ff38032d21860f22255
• WEBgithub.com/expressjs/express/releases/tag/4.22.0
• WEB