CVE-2019-18413: SQL Injection and Cross-site Scripting in class-validator
Summary
CVE-2019-18413: SQL Injection and Cross-site Scripting in class-validator. Affects class-validator versions < 0.14.0. Fixed in 0.14.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
class-validator is an npm package that provides input validation for TypeScript and JavaScript applications. It allows developers to define and enforce validation rules for various data types. However, a vulnerability exists in the package that allows attackers to bypass input validation and launch SQL Injection or Cross-site Scripting (XSS) attacks. This vulnerability arises due to the ability to overwrite internal attributes via a conflicting name. By injecting malicious input, an attacker can exploit this vulnerability to execute arbitrary SQL queries or inject malicious scripts into web pages.
Vulnerability Detail
The vulnerability in class-validator lies in the validate() function, where input validation can be bypassed by overwriting certain internal attributes. This can be achieved by using a conflicting name. Although there is an optional parameter called forbidUnknownValues that can reduce the risk of this bypass, it is not documented, and most developers configure input validation in the vulnerable default manner. As a result, attackers can exploit this vulnerability to perform SQL Injection or XSS attacks. The impact of these attacks can range from unauthorized data access to the execution of arbitrary code on the affected system.
How To Fix
Minimum fixed version
0.14.0
This is the first release that contains the fix.
npm install class-validator@0.14.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to explicitly set the forbidUnknownValues parameter to true when using the validate() function. This can be done by modifying the code as follows:
validate(input, { forbidUnknownValues: true });
Conclusion
In conclusion, the class-validator package is vulnerable to SQL Injection and Cross-site Scripting attacks due to a bypass in input validation. To mitigate this vulnerability, it is crucial to update the package to version 0.14.0 or later. Alternatively, the forbidUnknownValues parameter can be set to true as a temporary workaround. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for class-validator →
FAQ
class-validator is an npm package that provides input validation for TypeScript and JavaScript applications. It allows developers to define and enforce validation rules for various data types.
This vulnerability allows attackers to bypass input validation and launch SQL Injection or Cross-site Scripting (XSS) attacks. The impact can range from unauthorized data access to the execution of arbitrary code on the affected system.
To fix this vulnerability, update the class-validator package to version 0.14.0 or later. This version includes changes to the default settings that mitigate the risk of the bypass.
Yes, if updating the package is not immediately feasible, a temporary workaround is to explicitly set the forbidUnknownValues parameter to true when using the validate() function.
For more information about this vulnerability, you can refer to the GitHub Security Advisory GHSA-fj58-h2fr-3pp2 or the Vulert Playground at Vulert Scanner.
