CVE-2021-23328: Prototype Pollution in iniparserjs
Summary
CVE-2021-23328: Prototype Pollution in iniparserjs. Affects iniparserjs versions < 1.0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
iniparserjs is an npm package that provides functionality for parsing INI files in JavaScript. It allows users to read and manipulate INI files in their applications. However, all versions of iniparserjs are vulnerable to prototype pollution when the ini_parser.js file is handling arrays. This vulnerability can be exploited by an attacker to overwrite and pollute the object prototype of a program.
Vulnerability Detail
The vulnerability arises due to improper handling of user input in the ini_parser.js file. When arrays are processed, an attacker can inject malicious data that can modify the prototype of the program. This can lead to various security issues, such as remote code execution, information disclosure, or denial of service attacks. The severity of this vulnerability is rated as MODERATE with a CVSS score of 5.6.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is currently no known workaround for this vulnerability. It is recommended to update to a patched version of iniparserjs as soon as possible.
Conclusion
The vulnerability in iniparserjs allows for prototype pollution, which can have various security implications. It is crucial to update to a patched version of iniparserjs and review user input to prevent any potential injection attacks. For further assistance, please reach out to DevNack.com.
See every vulnerability recorded for iniparserjs →
FAQ
iniparserjs is an npm package that provides functionality for parsing INI files in JavaScript.
Prototype pollution is a vulnerability that occurs when an attacker can inject properties into an object's prototype, leading to unexpected behavior or security issues.
This vulnerability can be exploited by an attacker to execute arbitrary code, disclose sensitive information, or cause a denial of service.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and it will provide real-time alerts for open-source vulnerabilities.
For further support on vulnerability remediation, you can contact info@devnack.com.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
