Joomla! Issue Tracker - CMS

Download
Launch
Feeling Lucky

[#31632] - [4.0] Upstream Security issue

NPM Resource Changed ? Pending

User tests: Successful: Unsuccessful:

avatar brianteeman
brianteeman
10 Dec 2020

Bumps ini from 1.3.5 to 1.3.7. This update includes a security fix.

Sourced from The GitHub Security Advisory Database.

Vulnerabilities fixed

Prototype Pollution

Overview

The ini npm package before version 1.3.6 has a Prototype Pollution vulnerability.

If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

Patches

This has been patched in 1.3.6

Steps to reproduce

payload.ini

[__proto__]
polluted = "polluted"

poc.js:

var fs = require('fs')
</tr></table> ... (truncated)

Affected versions: < 1.3.6

Commits
  • c74c8af 1.3.7
  • 024b8b5 update deps, add linting
  • 032fbaf Use Object.create(null) to avoid default object property hazards
  • 2da9039 1.3.6
  • cfea636 better git push script, before publish instead of after
  • 56d2805 do not allow invalid hazardous string as section name
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by isaacs, a new releaser for ini since your current version.


Votes

# of Users Experiencing Issue
1/1
Average Importance Score
5.00
avatar brianteeman brianteeman - open - 10 Dec 2020
avatar brianteeman brianteeman - change - 10 Dec 2020
Status New ⇒ Pending
avatar joomla-cms-bot joomla-cms-bot - change - 10 Dec 2020
Category ⇒ NPM Change
avatar wilsonge wilsonge - change - 11 Dec 2020
Status Pending ⇒ Fixed in Code Base
Closed_Date 0000-00-00 00:00:00 ⇒ 2020-12-11 11:52:57
Closed_By ⇒ wilsonge
Labels Added: NPM Resource Changed ?
avatar wilsonge wilsonge - close - 11 Dec 2020
avatar wilsonge wilsonge - merge - 11 Dec 2020
avatar wilsonge
wilsonge - comment - 11 Dec 2020

Thanks!

avatar brianteeman
brianteeman - comment - 11 Dec 2020

thanks

avatar mattpilleul mattpilleul - test_item - 12 Dec 2020 - Tested unsuccessfully
avatar brianteeman
brianteeman - comment - 12 Dec 2020

@mattpilleul completely unrelated to this PR which was already merged yesterday. Please open a new issue

avatar mattpilleul
mattpilleul - comment - 12 Dec 2020

@mattpilleul completely unrelated to this PR which was already merged yesterday. Please open a new issue

Sorry mate ! Just removed my comments ?

Add a Comment

Login with GitHub to post a comment