qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - express: qs prototype poisoning causes the hang of the node process (CVE-2022-24999)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0808 advisory.

  - The go command may execute arbitrary code at build time when using cgo. This may occur when running go     get on a malicious module, or when running any other command which builds untrusted code. This is can by     triggered by linker flags, specified via a #cgo LDFLAGS directive. Flags containing embedded spaces are     mishandled, allowing disallowed flags to be smuggled through the LDFLAGS sanitization by including them in     the argument of another flag. This only affects usage of the gccgo compiler. (CVE-2023-29405)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. (CVE-2022-38900)

  - The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
    (CVE-2022-33987)

  - Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the     name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3. (CVE-2022-37601)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2023-0613 advisory.

  - A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as     @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states we are in     the process of marking this report as invalid; however, some third parties takes the position that A     prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge     or deep cloning but also when a target object is polluted. (CVE-2022-37616)

  - When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by     finalizing the operation with a rename from a temporary name to the final target file name.In that rename     operation, it might accidentally *widen* the permissions for the target file, leaving the updated file     accessible to more users than intended. (CVE-2022-32207)

  - An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the     XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to     access an array at a negative 2GB offset, typically leading to a segmentation fault. (CVE-2022-40303)

  - An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a     hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be     provoked. (CVE-2022-40304)

  - There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName.
    X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME     incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently     interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. When CRL     checking is enabled (i.e. the application sets the X509_V_FLAG_CRL_CHECK flag), this vulnerability may     allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or     enact a denial of service. In most cases, the attack requires the attacker to provide both the certificate     chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these     inputs, the other input must already contain an X.400 address as a CRL distribution point, which is     uncommon. As such, this vulnerability is most likely to only affect applications which have implemented     their own functionality for retrieving CRLs over a network. (CVE-2023-0286)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:0050 advisory.

  - Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
    (CVE-2021-44906)

  - node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor (CVE-2022-0235)

  - qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node     process hang for an Express application because an __ proto__ key can be used. In many typical Express use     cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that     is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was     backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3,     which has deps: qs@6.9.7 in its release description, is not vulnerable). (CVE-2022-24999)

  - A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of     Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of     Service. (CVE-2022-3517)

  - A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due     to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly     check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this     issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is     to complete the fix. (CVE-2022-43548)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Cognos Analytics installed on the remote host is 11.1.x prior to 11.1.7 Fix Pack 7 or 11.2.x prior to 11.2.4 FP2. It is, therefore, affected by multiple vulnerabilities, including the following:

  - netplex json-smart-v2 is vulnerable to a denial of service, caused by not limiting the nesting of arrays   or objects. By sending a specially crafted input, a remote attacker could exploit this vulnerability to   cause a stack exhaustion and crash the software. (CVE-2023-1370)

  - Express.js Express is vulnerable to a denial of service, caused by a prototype pollution flaw in qs. By   adding or modifying properties of Object.prototype using a __proto__ or constructor payload, a remote   attacker could exploit this vulnerability to cause a denial of service condition. (CVE-2022-24999)

  - IBM Cognos Analytics is vulnerable to stored cross-site scripting, caused by improper validation of SVG   Files in Custom Visualizations. A remote attacker could exploit this vulnerability to execute scripts in a   victim's Web browser within the security context of the hosting Web site. An attacker could use this   vulnerability to steal the victim's cookie-based authentication credentials. (CVE-2023-28530)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1742 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (14.21.3).

    Security Fix(es):

    * decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)

    * glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

    * nodejs: Improper handling of URI Subject Alternative Names (CVE-2021-44531)

    * nodejs: Certificate Verification Bypass via String Injection (CVE-2021-44532)

    * nodejs: Incorrect handling of certificate subject and issuer fields (CVE-2021-44533)

    * minimist: prototype pollution (CVE-2021-44906)

    * node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)

    * nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)

    * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

    * express: qs prototype poisoning causes the hang of the node process (CVE-2022-24999)

    * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

    * nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)

    * nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)

    * Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

    * nodejs: Prototype pollution via console.table properties (CVE-2022-21824)

    * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1533 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (14.21.3).

    Security Fix(es):

    * decode-uri-component: improper input validation resulting in DoS (CVE-2022-38900)

    * glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

    * minimist: prototype pollution (CVE-2021-44906)

    * nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)

    * c-ares: buffer overflow in config_sortlist() due to missing string length check (CVE-2022-4904)

    * express: qs prototype poisoning causes the hang of the node process (CVE-2022-24999)

    * http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2022-25881)

    * nodejs: HTTP Request Smuggling due to incorrect parsing of header fields (CVE-2022-35256)

    * nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)

    * Node.js: Permissions policies can be bypassed via process.mainModule (CVE-2023-23918)

    * Node.js: insecure loading of ICU data through ICU_DATA environment variable (CVE-2023-23920)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0612 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs14-nodejs (14.21.1), rh-     nodejs14-nodejs-nodemon (2.0.20). (BZ#2129806, BZ#2135519, BZ#2135520, BZ#2141022)

    Security Fix(es):

    * glob-parent: Regular Expression Denial of Service (CVE-2021-35065)

    * minimist: prototype pollution (CVE-2021-44906)

    * node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)

    * nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)

    * express: qs prototype poisoning causes the hang of the node process (CVE-2022-24999)

    * nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * rh-nodejs14-nodejs: Provide full-i18n subpackage (BZ#2009880)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3299 advisory.

  - qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node     process hang for an Express application because an __ proto__ key can be used. In many typical Express use     cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that     is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was     backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3,     which has deps: qs@6.9.7 in its release description, is not vulnerable). (CVE-2022-24999)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:0050 advisory.

  - Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
    (CVE-2021-44906)

  - node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor (CVE-2022-0235)

  - A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of     Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of     Service. (CVE-2022-3517)

  - qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node     process hang for an Express application because an __ proto__ key can be used. In many typical Express use     cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that     is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was     backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3,     which has deps: qs@6.9.7 in its release description, is not vulnerable). (CVE-2022-24999)

  - A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due     to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly     check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this     issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is     to complete the fix. (CVE-2022-43548)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-0050 advisory.

    - Apply upstream fix for CVE-2022-24999       Resolves: CVE-2022-24999
    - Record CVEs fixed by current or previous upstream releases       Resolves: CVE-2021-44906

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0050 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (14.21.1), nodejs-nodemon     (2.0.20).

    Security Fix(es):

    * minimist: prototype pollution (CVE-2021-44906)

    * node-fetch: exposure of sensitive information to an unauthorized actor (CVE-2022-0235)

    * nodejs-minimatch: ReDoS via the braceExpand function (CVE-2022-3517)

    * express: qs prototype poisoning causes the hang of the node process (CVE-2022-24999)

    * nodejs: DNS rebinding in inspect via invalid octal IP address (CVE-2022-43548)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:0050 advisory.

  - Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
    (CVE-2021-44906)

  - node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor (CVE-2022-0235)

  - qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node     process hang for an Express application because an __ proto__ key can be used. In many typical Express use     cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that     is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was     backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3,     which has deps: qs@6.9.7 in its release description, is not vulnerable). (CVE-2022-24999)

  - A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of     Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of     Service. (CVE-2022-3517)

  - A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due     to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly     check if an IP address is invalid before making DBS requests allowing rebinding attacks.The fix for this     issue in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32212 was incomplete and this new CVE is     to complete the fix. (CVE-2022-43548)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199792	RHEL 8 : qs (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
194928	Splunk Enterprise 8.2.0 < 8.2.12, 9.0.0 < 9.0.6, 9.1.0 < 9.1.1 (SVD-2023-0808)	Nessus	CGI abuses	critical
194919	Splunk Enterprise < 8.1.14, 8.2.0 < 8.2.11, 9.0.0 < 9.0.5 (SVD-2023-0613)	Nessus	CGI abuses	critical
184632	Rocky Linux 8 : nodejs:14 (RLSA-2023:0050)	Nessus	Rocky Linux Local Security Checks	critical
178850	IBM Cognos Analytics Multiple Vulnerabilities (7012621)	Nessus	CGI abuses	medium
174178	RHEL 8 : nodejs:14 (RHSA-2023:1742)	Nessus	Red Hat Local Security Checks	critical
173777	RHEL 8 : nodejs:14 (RHSA-2023:1533)	Nessus	Red Hat Local Security Checks	critical
171023	RHEL 7 : rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon (RHSA-2023:0612)	Nessus	Red Hat Local Security Checks	critical
170893	Debian DLA-3299-1 : node-qs - LTS security update	Nessus	Debian Local Security Checks	high
169724	AlmaLinux 8 : nodejs:14 (ALSA-2023:0050)	Nessus	Alma Linux Local Security Checks	critical
169719	Oracle Linux 8 : nodejs:14 (ELSA-2023-0050)	Nessus	Oracle Linux Local Security Checks	critical
169710	RHEL 8 : nodejs:14 (RHSA-2023:0050)	Nessus	Red Hat Local Security Checks	critical
169705	CentOS 8 : nodejs:14 (CESA-2023:0050)	Nessus	CentOS Local Security Checks	critical

Detections

Analytics

CVE-2022-24999

high

Tenable Plugins

high

critical

critical

critical

medium

critical

critical

critical

high

critical

critical

critical

critical