CVE-2022-23624 Validation bypass in frourio-express
Attackers can bypass input validation in frourio-express when using class-validator, potentially leading to unauthorized actions or data manipulation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23624?
CVE-2022-23624 is a high-severity missing authorization vulnerability in frouriojs frourio-express, published on 7 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Validators do not work properly for request bodies and queries in specific situations and some input is not validated at all. Users are advised to update frourio to v0.26.0 or later and to install `class-transformer` and `reflect-metadata`.
Which versions are affected by CVE-2022-23624?
2 open source packages ship an affected version, including frourio-express. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
frourio-express npm | All versions | 0.26.0 |
frourio-express npm | All versions | 0.26.0 |
Products include Frourio Frourio-Express.
How do I fix CVE-2022-23624?
Upgrade frourio-express to 0.26.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-23624 being exploited?
There is no known exploitation of CVE-2022-23624 in the wild and no public exploit code.
Sources
Also known as GHSA-mmj4-777p-fpq9.