Executive brief
ini-parser is a Node.js library used to parse INI configuration files. The library fails to protect against prototype pollution attacks, allowing attackers to inject or modify properties on all JavaScript objects in an application. This can lead to application malfunction, data tampering, or complete system compromise depending on how the parsed configuration is used.
Technical details
The vulnerability is a prototype pollution flaw (CWE-915) in the parse() function that handles INI file parsing. The parser directly assigns user-controlled values to object properties without sanitizing keys like "__proto__", "constructor", or "prototype", which allows an attacker to pollute the Object prototype. By crafting a malicious INI file, an attacker can add or modify properties that will exist on all objects in the JavaScript runtime. No fix is currently available; all versions are affected through at least version 0.0.2. The attack requires the application to parse attacker-controlled or compromised INI configuration files.
Affected products
- npm ini-parser 0.0.2 and earlier (all versions)
Timeline
- 2020-04-02: disclosed: NVD publication date
- 2020-06-10: advisory: GitHub Security Advisory GHSA-96r7-mrqf-jhcc published
- 2020-06-10: other: Severity updated to Critical (9.8) in OSV database