Executive brief
Properties-Reader is a Node.js library used to parse and read properties files. Before version 2.2.0, it is vulnerable to prototype pollution—a JavaScript-specific attack where malicious properties files can modify core JavaScript object prototypes. An attacker can exploit this to manipulate application behavior, potentially leading to privilege escalation, authentication bypass, or arbitrary code execution depending on how the application uses affected objects.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in Properties-Reader versions before 2.2.0. The library fails to safely handle property names in parsed files, allowing an attacker to inject a `__proto__` key that pollutes the Object prototype. No authentication or special privileges are required—an attacker only needs to supply a malicious properties file to the application. Once parsed, the pollution affects all downstream JavaScript objects in the application's runtime. The issue is patched in version 2.2.0 and subsequent releases.
Affected products
- steveukx properties-reader before 2.2.0
Timeline
- 2020-12-30: disclosed: Vulnerability reported to GitHub
- 2022-07-19: patched: Fix released in version 2.2.0
- 2022-07-19: advisory: GHSA advisory published
- 2022-07-25: other: CVE-2020-28471 published by NVD