Prototype pollution in ini - CVE-2020-7788

Vulnerability identifier: #VU66955

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-7788

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper input validation when handling INI files. A remote attacker can pass a specially crafted INI file to the application and perform prototype pollution attacks.

ini
Planning Analytics Local
mongo-express
QRadar Pulse App
Cloud Pak for Security (CP4S)
IBM Watson Machine Learning Accelerator
Anolis OS
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Oracle Linux
openEuler
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
rh-nodejs12-nodejs-nodemon (Red Hat package)
rh-nodejs14-nodejs-nodemon (Red Hat package)
nodejs-nodemon
nodejs-nodemon (Red Hat package)
npm
v8-devel
rh-nodejs10-nodejs (Red Hat package)
rh-nodejs12-nodejs (Red Hat package)
nodejs-docs
nodejs-devel
nodejs-debugsource
nodejs-libs
nodejs-debuginfo
nodejs-full-i18n
nodejs
rh-nodejs14-nodejs (Red Hat package)
nodejs (Red Hat package)
nodejs-packaging
IBM Cloud Pak System
IBM Cloud Automation Manager

Install updates from vendor's website.

ini - update to 1.3.6
mongo-express - update to 1.0.0
QRadar Pulse App - update to 2.2.9
Cloud Pak for Security (CP4S) - update to 1.10.15.0
rh-nodejs12-nodejs-nodemon (Red Hat package) - addressed in versions 2.0.3-1.el7, 2.0.3-5.el7
rh-nodejs14-nodejs-nodemon (Red Hat package) - update to 2.0.3-5.el7
nodejs-nodemon - update to 2.0.15-1
nodejs-nodemon (Red Hat package) - update to 2.0.19-1.el9_0
IBM Cloud Pak System - update to 2.3.3.5
IBM Cloud Automation Manager - update to 4.2.0.1 iFix 2
npm - addressed in versions 6.14.15-1.14.18.2.2, 8.1.2-1.16.13.1.3
npm - update to 6.14.16-1.12.22.11.1
v8-devel - update to 7.8.279.23-1.12.22.11.1
rh-nodejs10-nodejs (Red Hat package) - update to 10.23.1-2.el7
rh-nodejs12-nodejs (Red Hat package) - addressed in versions 12.20.1-1.el7, 12.22.5-1.el7
nodejs-docs - update to 12.22.11-1
nodejs-devel - update to 12.22.11-1
nodejs-debugsource - update to 12.22.11-1
nodejs-libs - update to 12.22.11-1
nodejs-debuginfo - update to 12.22.11-1
nodejs-full-i18n - update to 12.22.11-1
nodejs - update to 12.22.11-1
rh-nodejs14-nodejs (Red Hat package) - addressed in versions 14.15.4-2.el7, 14.17.5-1.el7
nodejs-docs - addressed in versions 14.18.2-2, 16.13.1-3
nodejs-full-i18n - addressed in versions 14.18.2-2, 16.13.1-3
nodejs-devel - addressed in versions 14.18.2-2, 16.13.1-3
nodejs - addressed in versions 14.18.2-2, 16.13.1-3
nodejs (Red Hat package) - update to 16.16.0-1.el9_0
nodejs-packaging - addressed in versions 23-3, 25-1

• https://snyk.io/vuln/SNYK-JS-INI-1048974
• https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1
• https://github.com/advisories/GHSA-qqgx-2p2h-9c37

• Prototype pollution in INI for Node.js
• Multiple vulnerabilities in mongo-express
• Multiple vulnerabilities in IBM Planning Analytics Workspace
• Red Hat Enterprise Linux 9 update for nodejs and nodejs-nodemon
• Multiple vulnerabilities in IBM QRadar Pulse for QRadar SIEM
• Multiple vulnerabilities in Oracle Linux
• Red Hat Software Collections update for rh-nodejs14-nodejs and rh-nodejs14-nodejs-nodemon
• Red Hat Software Collections update for rh-nodejs12-nodejs and rh-nodejs12-nodejs-nodemon
• Prototype pollution in IBM Cloud Automation Manager
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• openEuler update for nodejs
• Red Hat Software Collections update for rh-nodejs14-nodejs
• Red Hat Software Collections update for rh-nodejs12-nodejs
• Red Hat Software Collections update for rh-nodejs10-nodejs
• Red Hat Enterprise Linux 8 update for the nodejs:10 module
• Red Hat Enterprise Linux 8 update for the nodejs:12 module
• Red Hat Enterprise Linux 8 update for the nodejs:14 module
• Red Hat Enterprise Linux 8 update for the nodejs:16 module
• Red Hat Enterprise Linux 8 update for the nodejs:14 module
• Red Hat Enterprise Linux 8 update for the nodejs:14 module
• Multiple vulnerabilities in IBM Cloud Pak System
• Anolis OS update for nodejs:16 module
• Anolis OS update for nodejs:14 module