Prototype Pollution

Vulnerability

Description

The tiny-conf package for Node.js is vulnerable to Prototype Pollution through its set function [2]. The function does not sanitize property paths, allowing an attacker to assign values to properties like __proto__, constructor, or prototype. This flaw affects all versions of the package [2].

Exploitation

An attacker can exploit this by providing a crafted object or path that targets the __proto__ property. When the set function iterates over the path, it can pollute Object.prototype with arbitrary properties. This attack requires no authentication and can be triggered via user-supplied input that is passed to the set function, such as configuration data [3].

Impact

Successful exploitation can lead to denial of service (DoS) by adding properties that cause exceptions, or, in more severe scenarios, to remote code execution (RCE) if the polluted properties alter application logic [3].

Mitigation

As of the CVE publication date, no patched version of tiny-conf is available. Users are advised to avoid using the library if possible, or to apply the commit from the project's repository [1] which attempts to fix the issue, but this has not been officially released as a new version. Additionally, input validation can be used to prevent malicious paths from reaching the set function.