Executive brief
simple-plist is a JavaScript library used to parse and manipulate plist (property list) files commonly found in Apple software and configurations. A prototype pollution vulnerability in the parse() method allows attackers to inject malicious properties into JavaScript objects, potentially leading to denial of service, data modification, or code execution depending on how the application uses the parsed data.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in simple-plist v1.3.0's parse() method. By crafting a specially formed plist input, an attacker can pollute the Object prototype, affecting all objects in the application. The attack is network-reachable and requires no authentication or user interaction if the application parses untrusted plist data. An attacker can modify or add arbitrary properties to the prototype chain, potentially bypassing security checks, corrupting application state, or enabling remote code execution in certain contexts. The vulnerability was fixed in version 1.3.1.
Affected products
- simple-plist simple-plist before 1.3.1
Timeline
- 2022-03-23: disclosed
- 2022-03-23: patched: Fixed in version 1.3.1