Executive brief
frourio is a TypeScript framework for building type-safe APIs. This vulnerability allows attackers to bypass input validation on API requests due to improper handling of nested validators, potentially allowing malicious data to reach application logic without being checked. Applications relying on frourio's built-in validation may process unexpected or harmful input if they don't implement additional safeguards.
Technical details
The vulnerability is an improper input validation issue (CWE-20) affecting frourio's integration with the class-validator library. Nested validators fail to properly validate request bodies and query parameters in specific situations, and certain input patterns bypass validation entirely (false positives). The vulnerability is network-reachable via HTTP requests and does not require authentication or special privileges. Attackers can craft requests with invalid data that passes validation checks, potentially leading to data corruption or application logic exploitation. The issue affects all versions prior to v0.26.0; patching requires updating to v0.26.0 or later and adding class-transformer and reflect-metadata as dependencies.
Affected products
- frouriojs frourio < 0.26.0
Timeline
- 2022-02-07: disclosed
- 2022-02-07: patched: frourio v0.26.0 released