Executive brief
multi-ini is a JavaScript library used to parse INI configuration files. The library is vulnerable to prototype pollution, which allows an attacker to inject malicious properties into the core JavaScript object prototype. This can lead to unexpected application behavior, denial of service, or potential code execution depending on how the application uses the poisoned objects.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in multi-ini versions before 2.1.1. An attacker can specify a "proto" object within an array in the INI file to pollute the JavaScript object prototype. The attack requires no authentication and is triggered via a crafted INI file supplied to the library. Once the prototype is polluted, all objects in the application inherit the malicious properties, potentially enabling arbitrary property injection, denial of service, or in some cases arbitrary code execution. The fix was released in version 2.1.1 on December 10, 2020.
Affected products
- multi-ini multi-ini before 2.1.1
Timeline
- 2020-12-22: disclosed: NVD publication date
- 2020-12-10: patched: Fix merged in PR #37
- 2021-04-13: advisory: GHSA advisory published