Executive brief
The ini library is a widely used Node.js package for parsing INI configuration files. A prototype pollution vulnerability in versions before 1.3.6 allows an attacker to inject malicious INI content that corrupts the JavaScript object prototype, potentially leading to unexpected behavior, denial of service, or remote code execution in applications that depend on this library.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the ini.parse() function. An attacker can craft a malicious INI file containing a section named `__proto__` with arbitrary key-value pairs; when parsed, these entries pollute the Object prototype chain, affecting all JavaScript objects in the process. The attack requires only the ability to supply a malicious INI file to an application that uses ini.parse(); no authentication or user interaction is required beyond that. Depending on application logic, this can enable information disclosure, privilege escalation, or code execution. The vulnerability is fixed in version 1.3.6 by rejecting hazardous section names like `__proto__`.
Affected products
- npm ini before 1.3.6
Timeline
- 2020-12-10: disclosed
- 2020-12-10: patched: Version 1.3.6 released with fix