Executive brief
multi-ini is a Node.js library for parsing INI configuration files. The library is vulnerable to prototype pollution, a type of object manipulation attack that allows an attacker to modify the default properties inherited by all objects in the application. An attacker can exploit this by crafting a malicious INI file that pollutes the prototype chain, potentially leading to application crashes, unexpected behavior, or in some cases, remote code execution depending on how the application uses the parsed configuration.
Technical details
This vulnerability is a prototype pollution flaw (CWE-1321) in multi-ini before version 2.1.2, where an attacker can pollute an object's prototype by specifying the constructor.proto object as part of an array in a crafted INI file. The vulnerable component is the INI parser, which does not properly validate or sanitize object property names when merging configuration data. This is a bypass of a prior fix (CVE-2020-28448), indicating the initial patch was incomplete. The attack requires no authentication or user interaction, and is triggered when the application parses a malicious INI file via the network or from a local source. The fix is available in version 2.1.2.
Affected products
- multi-ini multi-ini before 2.1.2
Timeline
- 2020-12-22: disclosed
- 2021-04-13: advisory
- 2021-04-07: patched: Fix in version 2.1.2