Executive brief
kind-of is a popular Node.js library used to determine the type of JavaScript values. A validation bypass vulnerability allows attackers to craft malicious objects that trick the type checking logic, potentially causing applications that rely on kind-of's output to accept invalid data or bypass type-based security controls.
Technical details
The vulnerability is a validation bypass in kind-of versions 6.0.0 through 6.0.2, where the ctorName() function unsafely accesses the constructor property of user-supplied objects without verifying that the constructor is actually a function. An attacker can craft a JSON payload or JavaScript object with a malicious "constructor" property (e.g., {"constructor":{"name":"Symbol"}}) to override type detection results. The attack is local/internal (requires application to process attacker-controlled input), and an attacker can cause the type-checking function to return incorrect type names, allowing downstream security checks or validations to be bypassed. The fix, released in version 6.0.3, adds a typeof check to verify that val.constructor is actually a function before accessing its name property.
Affected products
- jonschlinkert kind-of 6.0.0 to 6.0.2
Timeline
- 2019-12-16: disclosed: Issue opened on GitHub
- 2020-03-31: advisory: GHSA and CVE published
- 2020-03-31: patched: Fix released in version 6.0.3