Evangelion1204 Multi-ini Resource Management Error Vulnerability

Evangelion1204 Multi-ini is Evangelion1204 individual developers of a Javascript-based language written for Ini configuration file parsing code base . The code base supports compatibility with the Zend file format. A security vulnerability exists in versions of multi-ini prior to 2.1.1, which ste...

Prototype Pollution in evangelion1204/multi-ini

Description multi-ini is vulnerable to Prototype Pollution. Proof of Concept 1. Create the following PoC and INI files: // poc.js const ini = require'multi-ini'; console.log"Before : " + .polluted; var content = ini.read'./payload.ini'; console.log"After : " + .polluted; //payload.ini constructor...

Prototype Pollution

Overview multi-ini is an ini-file parser which supports multi line, multiple levels and arrays to get a maximum of compatibility with Zend config files. Affected versions of this package are vulnerable to Prototype Pollution. It is possible to pollute an object's prototype by specifying the proto...