dot-qs Prototype Pollution Vulnerability Leading to Denial-of-Service

A prototype pollution vulnerability has been identified in the dot-qs library, specifically in version 0.2.0. This vulnerability allows attackers to manipulate the global prototype chain by supplying a crafted payload, potentially leading to a denial-of-service condition. Furthermore, if the polluted prototype property interacts with sensitive Node.js APIs, it could escalate to more severe injection-based attacks, such as executing arbitrary commands within the application's context.

Impact

Exploitation of this vulnerability causes a denial-of-service condition. However, due to the nature of prototype pollution, it could also lead to more serious injection-based attacks, depending on the application's use of the affected library and the integration with Node.js APIs.

Reproduction

The vulnerability can be reproduced by importing the dot-qs library and using the 'lib.parse' function to send a payload that includes an Object.prototype setter. This action introduces a new property into the prototype, which can be verified by checking the prototype of an object before and after the injection. The injected property can then be removed to clean up after the test.