Executive brief
iniparserjs is a library used to read and parse configuration files (INI files) in Node.js applications. A security flaw allows an attacker to manipulate the application's internal object structure by providing a specially crafted configuration file. This can lead to unauthorized changes in application behavior, data leakage, or service disruptions.
Technical details
The iniparserjs library is vulnerable to Prototype Pollution within its `ini_parser.js` component during array concatenation operations. By supplying a malicious INI file containing specially crafted keys (such as those targeting the `__proto__` property), an attacker can inject properties into the global Object prototype. This is a network-based attack with high complexity, as it requires the application to parse untrusted input using the library. Successful exploitation can lead to property injection, denial of service, or potentially remote code execution depending on how the application utilizes the polluted objects. As of the advisory date, no fixed version has been released.
Affected products
- iniparserjs project iniparserjs <= 1.0.4
Timeline
- 2021-01-29: disclosed: Vulnerability disclosed by Snyk and NVD
- 2021-04-13: advisory: GitHub Advisory published