CVE-2020-7788: Prototype Pollution
Overview The ini npm package before version 1.3.6 has a Prototype Pollution vulnerability.
If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Patches
This has been patched in 1.3.6.
Steps to reproduce
payload.ini [proto] polluted = "polluted"
poc.js: var fs = require('fs') var ini = require('ini')
var parsed = ini.parse(fs.readFileSync('./payload.ini', 'utf-8')) console.log(parsed) console.log(parsed.proto) console.log(polluted)
> node poc.js {} { polluted: 'polluted' } { polluted: 'polluted' } polluted
Other sources
A flaw was found in nodejs-ini. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Node.js ini module could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.
— IBM
This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-7788?
CVE-2020-7788 is a Prototype Pollution vulnerability in the `ini` npm package.
How severe is CVE-2020-7788?
CVE-2020-7788 has a severity rating of 9.8 (critical).
Which software packages are affected by CVE-2020-7788?
The `ini` npm package before version 1.3.6 is affected, as well as certain versions of `nodejs-ini`, `nodejs-nodemon`, `rh-nodejs14-nodejs`, `rh-nodejs12-nodejs`, `rh-nodejs12-nodejs-nodemon`, and `rh-nodejs10-nodejs`.
How can CVE-2020-7788 be fixed?
To fix CVE-2020-7788, upgrade to version 1.3.6 of the `ini` package.
Where can I find more information about CVE-2020-7788?
More information about CVE-2020-7788 can be found at the following references: [GitHub](https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1), [npm](https://www.npmjs.com/advisories/1589), [Snyk](https://snyk.io/vuln/SNYK-JS-INI-1048974).