Executive brief
tiny-conf is a Node.js configuration library that merges settings from files, environment variables, and command-line arguments. A prototype pollution vulnerability in the set() function allows attackers to inject malicious properties into JavaScript object prototypes, potentially leading to denial of service, property injection attacks, or remote code execution depending on how the application uses polluted properties.
Technical details
tiny-conf versions up to 1.1.0 are vulnerable to prototype pollution via the set() function due to improper handling of special keys like __proto__, constructor, and prototype. The vulnerability exists in the property-definition-by-path attack pattern, where an attacker can supply a crafted key string to pollute Object.prototype. The attack requires only network access to an application using tiny-conf and no authentication or user interaction. An attacker can call tinyConf.set('__proto__.polluted', true) to inject arbitrary properties into the base Object prototype, which are then inherited by all JavaScript objects in the application. This can lead to denial of service by breaking built-in methods (e.g., toString, valueOf), property injection attacks that bypass security checks (e.g., isAdmin flags), or remote code execution if the application evaluates polluted properties. A fix was implemented in commit 1f7be78 by filtering keys that contain '__proto__', 'prototype', or 'constructor' strings.
Affected products
- tiny-conf tiny-conf up to and including 1.1.0
Timeline
- 2020-08-17: disclosed
- 2020-09-01: other: CVE-2020-7724 published in NVD
- 2020-09-01: patched: Fix implemented via commit 1f7be78
- 2021-05-10: advisory: GitHub Security Advisory GHSA-4q97-fh3f-j294 published