Class-transformer: CVE-2020-7637

Created on 8 Apr 2020 · 10Comments · Source: typestack/class-transformer

Report from dependabot:

Vulnerable versions: <= 0.2.3
Patched version: No fix
class-transformer through 0.2.3 is vulnerable to Prototype Pollution. The 'classToPlainFromExist' function could be tricked into adding or modifying properties of 'Object.prototype' using a 'proto' payload.

Is this a known issue?

Source

ghost

👍53

Most helpful comment

FYI: https://github.com/nestjs/nest/issues/4598

As for this vulnerability, Nest handles this issue internally for several months already so our users shouldn't be affected. https://github.com/nestjs/nest/blob/master/packages/common/pipes/validation.pipe.ts#L159-L165

angristan on 20 Apr 2020

👍9 🎉1

All 10 comments

Just ran into this same issue too.

rdesaideveloper on 14 Apr 2020

Any chance of getting a fix for this soon?

FryDay on 15 Apr 2020

FYI: https://github.com/nestjs/nest/issues/4598

As for this vulnerability, Nest handles this issue internally for several months already so our users shouldn't be affected. https://github.com/nestjs/nest/blob/master/packages/common/pipes/validation.pipe.ts#L159-L165

angristan on 20 Apr 2020

👍9 🎉1

Available fixes to be reviewed:

https://github.com/typestack/class-transformer/pull/341
https://github.com/typestack/class-transformer/pull/342

@pleerock @NoNameProvided Could you take a look on this issue?

saulotoledo on 13 May 2020

❤5

@jotamorais Could you take a look on these? The PRs need to be carefully reviewed, but they are both small. This comment might be useful while reviewing the code.

saulotoledo on 25 Jun 2020

I will review later today and post an update.
Thanks!