Executive brief
nconf-toml is a TOML format plugin used to parse configuration files in Node.js applications. A prototype pollution vulnerability allows attackers to modify the behavior of the application, potentially causing service denial or executing arbitrary code when a malicious TOML file is parsed.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in nconf-toml versions 0.0.1 through 0.0.2 affecting how the library parses TOML configuration files. The vulnerability resides in the core parsing logic that does not properly sanitize object property assignments, allowing an attacker to inject properties into the prototype chain. An attacker can exploit this by crafting a malicious TOML configuration file that, when parsed by the application, modifies the Object prototype. This can lead to denial of service through application crashes or, in certain contexts, remote code execution. The vulnerability requires the application to process an attacker-controlled TOML file, but does not require authentication or user interaction beyond file processing.
Affected products
- nconf-toml nconf-toml 0.0.1 through 0.0.2
Timeline
- 2021-05-25: disclosed: NVD published
- 2021-06-07: disclosed: GHSA advisory published
- 2021-05-28: other: GitHub reviewed advisory