GHSA-FJ58-H2FR-3PP2

Vulnerability from github – Published: 2021-10-12 16:35 – Updated: 2023-01-11 21:59
VLAI?
Summary
SQL Injection and Cross-site Scripting in class-validator
Details

In TypeStack class-validator, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not documented and thus most developers configure input validation in the vulnerable default manner. With this vulnerability, attackers can launch SQL Injection or XSS attacks by injecting arbitrary malicious input.

The default settings for forbidUnknownValues has been changed to true in 0.14.0.

NOTE: a software maintainer agrees with the "is not documented" finding but suggests that much of the responsibility for the risk lies in a different product.

Severity ?
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "class-validator"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.14.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-18413"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-10-08T23:11:08Z",
    "nvd_published_at": "2019-10-24T18:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "In TypeStack class-validator, `validate()` input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional `forbidUnknownValues` parameter that can be used to reduce the risk of this bypass, this option is not documented and thus most developers configure input validation in the vulnerable default manner. With this vulnerability, attackers can launch SQL Injection or XSS attacks by injecting arbitrary malicious input.\n\nThe default settings for `forbidUnknownValues` has been changed to `true` in 0.14.0.\n\nNOTE: a software maintainer agrees with the \"is not documented\" finding but suggests that much of the responsibility for the risk lies in a different product.",
  "id": "GHSA-fj58-h2fr-3pp2",
  "modified": "2023-01-11T21:59:18Z",
  "published": "2021-10-12T16:35:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18413"
    },
    {
      "type": "WEB",
      "url": "https://github.com/typestack/class-validator/issues/1422#issuecomment-1344635415"
    },
    {
      "type": "WEB",
      "url": "https://github.com/typestack/class-validator/issues/438"
    },
    {
      "type": "WEB",
      "url": "https://github.com/typestack/class-validator/issues/438#issuecomment-964728471"
    },
    {
      "type": "WEB",
      "url": "https://github.com/typestack/class-validator/pull/1798"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/typestack/class-validator"
    },
    {
      "type": "WEB",
      "url": "https://github.com/typestack/class-validator#passing-options"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SQL Injection and Cross-site Scripting in class-validator"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.