Junglewise Threat Intelligence

CVE-2019-20149: kind-of validation bypass via malicious constructor property

CVE-2019-20149 · Severity: low · CVSS 3.1 · Published 2020-03-31

Vendors: Jonschlinkert, npm.

Executive brief

kind-of is a popular Node.js library used to determine the type of JavaScript values. A validation bypass vulnerability allows attackers to craft malicious objects that trick the type checking logic, potentially causing applications that rely on kind-of's output to accept invalid data or bypass type-based security controls.

Technical details

The vulnerability is a validation bypass in kind-of versions 6.0.0 through 6.0.2, where the ctorName() function unsafely accesses the constructor property of user-supplied objects without verifying that the constructor is actually a function. An attacker can craft a JSON payload or JavaScript object with a malicious "constructor" property (e.g., {"constructor":{"name":"Symbol"}}) to override type detection results. The attack is local/internal (requires application to process attacker-controlled input), and an attacker can cause the type-checking function to return incorrect type names, allowing downstream security checks or validations to be bypassed. The fix, released in version 6.0.3, adds a typeof check to verify that val.constructor is actually a function before accessing its name property.

Affected products

  • jonschlinkert kind-of 6.0.0 to 6.0.2

Timeline

  • 2019-12-16: disclosed: Issue opened on GitHub
  • 2020-03-31: advisory: GHSA and CVE published
  • 2020-03-31: patched: Fix released in version 6.0.3

References