PT-2019-5802 · Npm · Kind-Of

Xiaofen9 · Published 2019-12-30 · Updated 2021-05-25 · CVE-2019-20149

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions kind-of versions 6.0.0 through 6.0.2

Description The issue is related to insufficient input validation in the kind-of library, which can be exploited by a remote attacker to cause a denial of service. Specifically, the ctorName in index.js of kind-of version 6.0.2 allows external user input to overwrite internal attributes via a conflicting name. A crafted payload can manipulate the type detection result by overwriting a built-in attribute. This can enable attackers to bypass type checking validation.

Recommendations For kind-of versions 6.0.0 through 6.0.2, upgrade to version 6.0.3 or later.

Exploit

Fix

RCE

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-20

CWE-668

Related Identifiers

AZL-44298

AZL-47271

BDU:2021-02899

CVE-2019-20149

GHSA-6C8F-QPHG-QJGP

Affected Products

Kind-Of

References · 16

• 🔥 https://github.com/jonschlinkert/kind-of/issues/30 · Exploit
• https://github.com/jonschlinkert/kind-of/pull/31 · Patch
• https://ubuntu.com/security/CVE-2019-20149 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-20149 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-20149 · Security Note
• https://bdu.fstec.ru/vul/2021-02899 · Security Note
• https://osv.dev/vulnerability/AZL-47271 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-20149 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6c8f-qphg-qjgp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-20149 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44298 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-20149 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-20149 · Vendor Advisory
• https://github.com/jonschlinkert/kind-of/commit/1df992ce6d5a1292048e5fe9c52c5382f941ee0b · Note
• https://npmjs.com/advisories/1490 · Note