CVE-2020-28472: Prototype Pollution
This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited further depending on the context.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@aws-sdk/shared-ini-file-loaderto a version that resolves this vulnerability.Fixed in 1.0.0-rc.9 - Upgrade
Upgrade
aws-sdkto a version that resolves this vulnerability.Fixed in 2.814.0
Event History
Frequently Asked Questions
What is the severity of CVE-2020-28472?
The severity of CVE-2020-28472 is classified as high due to its potential to lead to prototype pollution in affected applications.
How do I fix CVE-2020-28472?
To fix CVE-2020-28472, upgrade the @aws-sdk/shared-ini-file-loader package to version 1.0.0-rc.9 or later and the aws-sdk package to version 2.814.0 or later.
Which versions are affected by CVE-2020-28472?
CVE-2020-28472 affects versions of the @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9 and aws-sdk before 2.814.0.
What impact does CVE-2020-28472 have on applications?
CVE-2020-28472 can allow an attacker to submit a malicious INI file that may lead to prototype pollution, compromising application integrity.
Are there any known exploits for CVE-2020-28472?
While specific exploits for CVE-2020-28472 have not been publicly disclosed, the vulnerability's nature poses a significant risk if left unaddressed.