{"id":"GHSA-mmj4-777p-fpq9","summary":"Validation bypass in frourio-express","details":"## 日本語\n\n### 影響\nv0.26.0以前のfrourioを使用している、かつvalidators/を利用している場合、ネストされたバリデータがリクエストのボディーとクエリに対して正しく働かないケースがあります。また、リクエストに対してバリデーションが効かなくなる入力があります。\n\n### パッチ\nfrourioをv0.26.0かそれ以降のバージョンにアップデートをお願いします。frourio を使用したプロジェクトには `class-transformer` と `reflect-metadata` の依存への追加も必要となります。\n\n### ワークアラウンド\ncontroller側で自分でclass-transformerを使用してチェックする、vaildatorを使わない、など。\n\n### さらなる情報\n\nこのセキュリティ勧告に関する質問やコメントについては、以下の方法でお問い合わせいただけます。\n* [frourio](https://github.com/frouriojs/frourio)にIssueを開く。\n\n## English\n\n### Impact\nFrourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder. Validators does not work properly for request bodies and queries in specific situations. Addtionally, some kind of input is not validated. (false positives)\n\n### Patches\nPlease update your frourio to v0.26.0 or later. You also need to install `class-transformer` and `reflect-metadata` to your project.\n\n### Workarounds\nValidate objects from request with class-transformer in controllers by yourself, or prevent using validators.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [frourio](https://github.com/frouriojs/frourio)\n","aliases":["CVE-2022-23624"],"modified":"2023-11-01T04:57:58.580219Z","published":"2022-02-07T22:38:37Z","database_specific":{"nvd_published_at":"2022-02-07T23:15:00Z","cwe_ids":["CWE-1321","CWE-20"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2022-02-07T22:38:37Z"},"references":[{"type":"WEB","url":"https://github.com/frouriojs/frourio-express/security/advisories/GHSA-mmj4-777p-fpq9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23624"},{"type":"WEB","url":"https://github.com/frouriojs/frourio-express/commit/73ded5c6f9f1c126c0cb2d05c0505e9e4db142d2"},{"type":"PACKAGE","url":"https://github.com/frouriojs/frourio-express"}],"affected":[{"package":{"name":"frourio-express","ecosystem":"npm","purl":"pkg:npm/frourio-express"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.26.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-mmj4-777p-fpq9/GHSA-mmj4-777p-fpq9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}