Code injection

2021-01-1911:15:00

PRIOn knowledge base

www.prio-n.com

9.3 High

AI Score

Confidence

High

0.014 Low

EPSS

Percentile

86.4%

JSON

This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited further depending on the context.

CPENameOperatorVersion
aws_sdk_for_javasciptlt2.814.0
aws_shared_configuration_file_loadereq1.0.0 alpha1
aws_shared_configuration_file_loadereq1.0.0 alpha2
aws_shared_configuration_file_loadereq1.0.0 alpha3
aws_shared_configuration_file_loadereq1.0.0 beta1
aws_shared_configuration_file_loadereq1.0.0 beta2
aws_shared_configuration_file_loadereq1.0.0 beta3
aws_shared_configuration_file_loadereq1.0.0 beta4
aws_shared_configuration_file_loadereq1.0.0 gamma1
aws_shared_configuration_file_loadereq1.0.0 gamma2

Name	Operator	Version
aws_sdk_for_javascipt	lt	2.814.0
aws_shared_configuration_file_loader	eq	1.0.0 alpha1
aws_shared_configuration_file_loader	eq	1.0.0 alpha2
aws_shared_configuration_file_loader	eq	1.0.0 alpha3
aws_shared_configuration_file_loader	eq	1.0.0 beta1
aws_shared_configuration_file_loader	eq	1.0.0 beta2
aws_shared_configuration_file_loader	eq	1.0.0 beta3
aws_shared_configuration_file_loader	eq	1.0.0 beta4
aws_shared_configuration_file_loader	eq	1.0.0 gamma1
aws_shared_configuration_file_loader	eq	1.0.0 gamma2