Is CVE-2020-28471 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-28471 being exploited in the wild.

How severe is CVE-2020-28471?

Low severity, with a CVSS score of 3.1, published 19 July 2022.

Which products and versions are affected?

properties-reader (npm) SEMVER:introduced=0,fixed=2.2.0.

Is there a fix for CVE-2020-28471?

Yes. properties-reader (npm): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-28471 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-28471?

Check whether you run properties-reader (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-28471: Properties-Reader prototype pollution

CVE-2020-28471 · Severity: low · CVSS 3.1 · Published 2022-07-19

Properties-Reader is a Node.js library used to parse and read properties files. Before version 2.2.0, it is vulnerable to prototype pollution—a JavaScript-specific attack where malicious properties files can modify core JavaScript object prototypes. An attacker can exploit this to manipulate application behavior, potentially leading to privilege escalation, authentication bypass, or arbitrary code execution depending on how the application uses affected objects.

Vendors: npm.

Quick answers

Is CVE-2020-28471 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-28471 being exploited in the wild.
How severe is CVE-2020-28471?: Low severity, with a CVSS score of 3.1, published 19 July 2022.
Which products and versions are affected?: properties-reader (npm) SEMVER:introduced=0,fixed=2.2.0.
Is there a fix for CVE-2020-28471?: Yes. properties-reader (npm): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-28471 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-28471?: Check whether you run properties-reader (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

properties-reader (npm): upgrade to 2.2.0 or later
```
npm install properties-reader@2.2.0
```

Technical details

The vulnerability is a prototype pollution flaw (CWE-1321) in Properties-Reader versions before 2.2.0. The library fails to safely handle property names in parsed files, allowing an attacker to inject a `__proto__` key that pollutes the Object prototype. No authentication or special privileges are required—an attacker only needs to supply a malicious properties file to the application. Once parsed, the pollution affects all downstream JavaScript objects in the application's runtime. The issue is patched in version 2.2.0 and subsequent releases.

Affected products

steveukx properties-reader before 2.2.0

Identifiers

CVE-2020-28471
GHSA-jxvf-m3x5-mxwq

Timeline

2020-12-30: disclosed: Vulnerability reported to GitHub
2022-07-19: patched: Fix released in version 2.2.0
2022-07-19: advisory: GHSA advisory published
2022-07-25: other: CVE-2020-28471 published by NVD

References

https://github.com/steveukx/properties/issues/40

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.