Executive brief
ion-parser is a JavaScript library for parsing TOML and INI configuration files. A prototype pollution vulnerability allows attackers to inject malicious properties into the base JavaScript Object prototype by submitting a specially crafted INI file. This can lead to application denial of service, security bypass (such as privilege escalation), or remote code execution depending on how the application uses parsed data.
Technical details
This prototype pollution vulnerability (CWE-1321) exists in all versions of ion-parser when parsing user-supplied INI files using the `parse()` function. The root cause is unsafe handling of special JavaScript property keys like `__proto__` during parsing, allowing an attacker to pollute the Object prototype. The attack requires only the ability to submit a malicious INI file to an application that parses it—no authentication or special privileges needed. Successful exploitation can pollute inherited object properties across the entire application, enabling denial of service (by breaking code that relies on Object methods), property injection (forged credentials or permissions), or remote code execution (if the application evaluates polluted properties). No patch is currently available for ion-parser; the package is unmaintained.
Affected products
- ion-parser ion-parser all versions up to 0.5.2
Timeline
- 2020-12-08: disclosed
- 2022-07-26: advisory: Published to GitHub Advisory Database