72 Days: A Transparency Report on CVE-2022-24999

The Uncomfortable Truth

Today at 10:47 AM CST, we deployed a fix for CVE-2022-24999 to security.dugganusa.com. The vulnerability—a prototype pollution flaw in the qs query string parser used by Express—had been present in our infrastructure for 72 days.

We're publishing this because you deserve to know.

What Was Vulnerable

CVE-2022-24999 is a High severity (CVSS 7.5) prototype pollution vulnerability affecting the qs package, which Express uses to parse query strings. An unauthenticated attacker could craft a malicious URL like:

?a[__proto__]=b&a[__proto__]&a[length]=100000000

This could cause a Node.js process hang—a denial of service condition.

The Timeline

Dwell time: 72 days from deployment to patch.

Why It Took 72 Days

Express 4.18.2 should have included patched dependencies. It didn't. The vulnerable qs version was pulled in through body-parser's transitive dependency chain—a classic supply chain visibility gap.

We run Dependabot continuously. The alert fired when npm's vulnerability database updated its transitive dependency analysis. Within 24 hours of detection, the fix was in production.

What We Fixed

{
  "overrides": {
    "qs": "6.14.1"
  }
}

That's it. One override in package.json forcing all transitive dependencies to use the patched qs version. Applied to both security.dugganusa.com and analytics.dugganusa.com.

Did Anyone Exploit This?

We reviewed 72 days of access logs. No exploitation attempts detected.

The attack signature (__proto__ in query strings) is distinctive. We searched for it. Nothing.

This doesn't mean we were safe—it means we were lucky.

Defense in Depth Saved Us

Even if exploited, the damage would have been limited:

1. Azure Container Apps auto-restarts crashed containers within seconds

2. Rate limiting at the CDN layer would throttle repeated attacks

3. No data exfiltration risk—CVE-2022-24999 is DoS-only, not RCE

4. Isolated services—a crash in security-dashboard doesn't affect analytics

Defense in depth isn't about preventing all vulnerabilities. It's about limiting blast radius when they slip through.

The Uncomfortable Math

• 72 days of exposure

• 7.5 CVSS severity

• 0 detected exploitation attempts

• 24 hours from detection to remediation

Was this acceptable? That depends on your risk tolerance. For a $77/month security dashboard serving threat intelligence feeds, we believe the residual risk was within acceptable bounds—but we'd prefer zero.

What We're Changing

1. Transitive dependency audits: Monthly manual review of npm ls output for critical packages

2. Override-first patching: When Dependabot flags a transitive vulnerability, apply overrides immediately rather than waiting for upstream fixes

3. Transparency reports: Publishing dwell time data quarterly

For Our Customers

If you consume our STIX feeds or threat intelligence APIs, your systems were never at risk. The vulnerability affected our web dashboards, not the data pipelines.

If you visited security.dugganusa.com or analytics.dugganusa.com during the 72-day window, your browser was not compromised. CVE-2022-24999 is a server-side DoS vulnerability—it cannot execute code on clients.

References

• NVD - CVE-2022-24999

• GitHub Advisory - GHSA-hrpp-h998-j3pp

• Snyk - Prototype Poisoning in qs

DugganUSA LLC operates threat intelligence infrastructure serving enterprise customers. We believe security vendors should be transparent about their own vulnerabilities—not just everyone else's.