Executive brief
frourio-express is a framework for building type-safe REST APIs in Express.js. In versions before 0.26.0, input validation fails for certain request bodies and query parameters, allowing invalid data to pass through without being checked. This could enable attackers to send malformed or malicious data that should have been rejected, potentially leading to application errors or exploitation of downstream logic.
Technical details
The vulnerability is an input validation bypass affecting frourio-express versions prior to 0.26.0 that use class-validator for request validation. Nested validators fail to properly validate request bodies and queries in specific cases, and certain input patterns bypass validation entirely (false negatives). The root cause involves improper handling of object transformation and validation, with contributing weakness in prototype attributes (CWE-1321). The attack vector is network-based with no authentication required; an attacker can send specially crafted requests that evade validation. The vulnerability was fixed in version 0.26.0, which requires additional dependencies (class-transformer and reflect-metadata) to be installed alongside the updated library.
Affected products
- frourio frourio-express <0.26.0
Timeline
- 2022-02-07: disclosed: Advisory published
- 2022-02-07: patched: Fix released in version 0.26.0