GitHub Advisoryadvisory · npm

GHSA-rrc9-gqf8-8rwg Prototype Pollution via file load in aws-sdk and @aws-sdk/shared-ini-file-loader

HIGH Published 2021-11-16 Modified 2021-04-06 Official page ↗
Aliases
CVE-2020-28472
Ecosystem
npm
Packages
aws-sdk, @aws-sdk/shared-ini-file-loader
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-1321
Reviewed
2021-04-06

Affected packages

• npm aws-sdk: < 2.814.0 → fixed in 2.814.0 • npm @aws-sdk/shared-ini-file-loader: < 1.0.0-rc.9 → fixed in 1.0.0-rc.9

Description

This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited further depending on the context.

Related

Alias · CVE (1)

  • CVE-2020-28472 This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References