Prototype Pollution
CVE-2020-28472

7.3HIGH

Key Information:

Vendor

Amazon

Status
@aws-sdk/shared-ini-file-loader
Aws-sdk
Vendor
CVE Published:
19 January 2021

What is CVE-2020-28472?

This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited further depending on the context.

Affected Version(s)

@aws-sdk/shared-ini-file-loader < 1.0.0-rc.9

aws-sdk < 2.814.0

References

https://snyk.io/vuln/SNYK-JS-AWSSDKSHAREDINIFILELOADER-10...
x_refsource_MISC
https://snyk.io/vuln/SNYK-JS-AWSSDK-1059424
x_refsource_MISC
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1059425
x_refsource_MISC

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eugene Lim
Government Technology Agency Cyber Security Group
.