Executive brief
class-validator is a popular input validation library for Node.js applications. A vulnerability in its default configuration allows attackers to bypass validation rules by injecting malicious data through conflicting attribute names, enabling SQL injection and cross-site scripting attacks. The vulnerability affects all versions before 0.14.0, which changed the default settings to be more secure.
Technical details
class-validator's validate() function can be bypassed because internal attributes can be overwritten via conflicting parameter names. Attackers can inject arbitrary malicious input that circumvents validation rules, even when validation decorators are in place. The vulnerability requires no authentication or user interaction and is exploitable over the network. While an optional forbidUnknownValues parameter exists to mitigate this, it is not documented by default and most developers do not enable it. The default behavior was changed to forbidUnknownValues:true in version 0.14.0.
Affected products
- TypeStack class-validator 0 to 0.13.x
Timeline
- 2019-10-24: disclosed
- 2021-10-12: advisory
- 2021: patched: Fix released in version 0.14.0