PT-2022-16138 · Unknown · Class-Validator+3

Lumakernel · Published 2022-02-07 · Updated 2023-07-13 · CVE-2022-23624

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Frourio-express versions prior to v0.26.0

Description Frourio-express is a minimal full stack framework for TypeScript. Users who use Frourio-express version prior to v0.26.0 and integrate with class-validator through the validators/ folder are subject to an input validation issue. Validators do not work properly for request bodies and queries in specific situations, and some input is not validated at all.

Recommendations Update Frourio-express to v0.26.0 or later. Install class-transformer and reflect-metadata to your project. As a temporary workaround, consider validating objects from requests with class-transformer in controllers by yourself, or prevent using validators.

Exploit

Fix

Prototype Pollution

RCE

Weakness Enumeration

CWE-1321

CWE-20

Related Identifiers

CVE-2022-23624

GHSA-MMJ4-777P-FPQ9

Affected Products

Frourio-Express

Class-Transformer

Class-Validator

Reflect-Metadata

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23624.json · Exploit
• https://github.com/frouriojs/frourio-express/commit/73ded5c6f9f1c126c0cb2d05c0505e9e4db142d2 · Patch
• https://osv.dev/vulnerability/GHSA-mmj4-777p-fpq9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23624 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23624 · Vendor Advisory
• https://github.com/frouriojs/frourio-express/security/advisories/GHSA-mmj4-777p-fpq9 · Note
• https://github.com/frouriojs/frourio-express · Note
• https://t.me/cvenotify/26413 · Telegram Post
• https://t.me/cibsecurity/36985 · Telegram Post