Critical Vulnerability in node-kind-of: Constructor Name Manipulation
Summary
CVE-2019-20149: ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Affects node-kind-of across 2 version ranges.
< 0b4ababf3a8505f60055487415a2dfe678a10b53
< 6.0.3+dfsg-1
Fixed in 6.0.3+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-kind-of package is a utility for determining the type of a given value in JavaScript. It is widely used in various applications to provide type detection functionality. However, in version 6.0.2, a vulnerability was discovered that allows external user input to overwrite internal attributes, specifically the constructor name, which can lead to incorrect type detection results.
Vulnerability Detail
The vulnerability, identified as CVE-2019-20149, arises from the ctorName function in index.js of the node-kind-of package version 6.0.2. It allows an attacker to manipulate the constructor name through crafted payloads, such as using 'constructor': {'name':'Symbol'}. This manipulation can lead to significant security risks, including the potential for type confusion and exploitation of the application relying on this package for type detection. The vulnerability affects multiple Debian ecosystems and can be exploited without authentication.
How To Fix
Minimum fixed version
6.0.3+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-kind-ofTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not feasible, consider implementing input validation to sanitize user inputs that may interact with the node-kind-of package. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The CVE-2019-20149 vulnerability in the node-kind-of package poses significant risks due to its ability to manipulate internal attributes through crafted payloads. It is crucial for users of this package to update to the latest version to ensure their applications remain secure. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for node-kind-of →
FAQ
CVE-2019-20149 is a vulnerability in the node-kind-of package that allows external manipulation of internal attributes, leading to incorrect type detection.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions of node-kind-of prior to 6.0.3+dfsg-1 are affected by this vulnerability.
The vulnerability can lead to type confusion, which may allow attackers to exploit applications that rely on accurate type detection, potentially leading to further security breaches.
Yes, implementing input validation to sanitize user inputs can help mitigate the risk until an update is applied.
Related vulnerabilities
Recent vulnerabilities recorded for node-kind-of.
