CVE-2019-20149: kind-of validation bypass via malicious constructor property

CVE-2019-20149 · Severity: low · CVSS 3.1 · Published 2020-03-31

kind-of is a popular Node.js library used to determine the type of JavaScript values. A validation bypass vulnerability allows attackers to craft malicious objects that trick the type checking logic, potentially causing applications that rely on kind-of's output to accept invalid data or bypass type-based security controls.

Vendors: npm.

Quick answers

Is CVE-2019-20149 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2019-20149 being exploited in the wild.
How severe is CVE-2019-20149?
Low severity, with a CVSS score of 3.1, published 31 March 2020.
Which products and versions are affected?
kind-of (npm) SEMVER:introduced=6.0.0,fixed=6.0.3.
Is there a fix for CVE-2019-20149?
Yes. kind-of (npm): upgrade to 6.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-20149 attacked?
It is attacked over the network.
Am I affected by CVE-2019-20149?
Check whether you run kind-of (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • kind-of (npm): upgrade to 6.0.3 or later
    npm install kind-of@6.0.3

Technical details

The vulnerability is a validation bypass in kind-of versions 6.0.0 through 6.0.2, where the ctorName() function unsafely accesses the constructor property of user-supplied objects without verifying that the constructor is actually a function. An attacker can craft a JSON payload or JavaScript object with a malicious "constructor" property (e.g., {"constructor":{"name":"Symbol"}}) to override type detection results. The attack is local/internal (requires application to process attacker-controlled input), and an attacker can cause the type-checking function to return incorrect type names, allowing downstream security checks or validations to be bypassed. The fix, released in version 6.0.3, adds a typeof check to verify that val.constructor is actually a function before accessing its name property.

Affected products

  • jonschlinkert kind-of 6.0.0 to 6.0.2

Identifiers

  • CVE-2019-20149
  • GHSA-6c8f-qphg-qjgp

Timeline

  • 2019-12-16: disclosed: Issue opened on GitHub
  • 2020-03-31: advisory: GHSA and CVE published
  • 2020-03-31: patched: Fix released in version 6.0.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.