CVE-2020-7637: Prototype Pollution in class-transformer
Summary
CVE-2020-7637: Prototype pollution in class-transformer. Affects class-transformer versions < 0.3.1. Fixed in 0.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
class-transformer is an npm package that provides decorators and functions for transforming plain objects to class instances and vice versa. It is commonly used in JavaScript and TypeScript projects to simplify object manipulation and serialization. Unfortunately, versions up to 0.2.3 of class-transformer are vulnerable to Prototype Pollution.
Vulnerability Detail
The vulnerability in class-transformer arises from the 'classToPlainFromExist' function, which can be tricked into adding or modifying properties of 'Object.prototype' using a 'proto' payload. This allows an attacker to pollute the prototype of all objects in the application, potentially leading to unexpected behavior or security issues.
How To Fix
Minimum fixed version
0.3.1
This is the first release that contains the fix.
npm install class-transformer@0.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update to the latest version of class-transformer, a possible workaround is to avoid using the 'classToPlainFromExist' function. Instead, consider using alternative methods provided by the package or implementing custom serialization logic.
Conclusion
In conclusion, class-transformer versions up to 0.2.3 are vulnerable to Prototype Pollution. It is crucial to update to version 0.3.1 or later to fix this issue. If updating is not possible, consider using alternative methods or implementing custom serialization logic. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for class-transformer →
FAQ
Prototype Pollution is a vulnerability that occurs when an attacker can modify the prototype of an object, allowing them to add or modify properties that affect all instances of that object.
'classToPlainFromExist' is a function provided by class-transformer that converts a class instance to a plain object, while also preserving existing properties of the target object.
'proto' is a special property in JavaScript that allows direct manipulation of an object's prototype. By setting 'proto' to a malicious value, an attacker can pollute the prototype chain.
The consequences of this vulnerability depend on how the affected package is used in the application. It could lead to unexpected behavior, security vulnerabilities, or enable an attacker to execute arbitrary code.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to update to the latest version to mitigate any potential risks.
