Executive brief
The plist.js library is a Node.js package that parses Apple property list files (used for configuration and data storage). A prototype pollution vulnerability in its XML parsing function allows attackers to inject malicious data that corrupts JavaScript object prototypes, potentially causing application crashes or unexpected behavior. This can be exploited remotely without authentication by providing a specially crafted plist file.
Technical details
A prototype pollution vulnerability exists in the plist.js library's .parse() function when processing XML plist files. The vulnerability is triggered when a plist XML contains a <key> element with the value __proto__, which is then used as an object property name without sanitization. This allows an attacker to modify the JavaScript Object prototype chain, affecting all objects in the application. The attack requires no authentication and can be triggered remotely by providing a malicious plist file. The vulnerability can lead to denial of service through infinite loops or property manipulation, and potentially remote code execution depending on how the parsed data is used. The fix, introduced in version 3.0.5, adds validation to prevent __proto__ and similar keys from being processed during dict parsing.
Affected products
- TooTallNate plist.js before 3.0.5
Timeline
- 2022-01-06: disclosed
- 2022-02-18: advisory
- 2022-03-21: patched