CVE-2020-28471
📋 TL;DR
CVE-2020-28471 is a prototype pollution vulnerability in the properties-reader npm package that allows attackers to inject arbitrary properties into JavaScript objects. This affects applications using properties-reader to parse .properties files, potentially leading to denial of service or remote code execution. Any Node.js application using vulnerable versions of this package is affected.
💻 Affected Systems
- properties-reader npm package
📦 What is this software?
Properties Reader by Properties Reader Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Denial of service through application crashes or unexpected behavior modification.
If Mitigated
Limited impact if input validation and sandboxing prevent prototype pollution exploitation.
🎯 Exploit Status
Proof-of-concept exploit code is publicly available in GitHub issues. Exploitation requires the application to parse attacker-controlled .properties files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.2.0
Vendor Advisory: https://github.com/steveukx/properties/commit/0877cc871db9865f58dd9389ce99e61be05380a5
Restart Required: Yes
Instructions:
1. Update package.json to specify 'properties-reader': '>=2.2.0'. 2. Run 'npm update properties-reader' or 'yarn upgrade properties-reader'. 3. Restart all Node.js applications using this package.
🔧 Temporary Workarounds
Input validation for .properties files
allValidate and sanitize all .properties file inputs before parsing
Use Object.freeze() on prototypes
allFreeze Object.prototype to prevent prototype pollution
Object.freeze(Object.prototype);
🧯 If You Can't Patch
- Implement strict input validation for all .properties file sources
- Isolate the vulnerable component in a sandboxed environment with limited permissions
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list properties-reader' to see installed versionCheck Version:
npm list properties-reader | grep properties-readerVerify Fix Applied:
Confirm version is 2.2.0 or higher with 'npm list properties-reader'📡 Detection & Monitoring
Log Indicators:
- Unexpected application crashes when parsing .properties files
- Unusual prototype property modifications in application logs
Network Indicators:
- HTTP requests with malicious .properties file uploads
- Unusual file upload patterns to endpoints accepting .properties files
SIEM Query:
source="application.logs" AND ("prototype pollution" OR "properties-reader" OR ".properties file parse error")🔗 References
- https://github.com/steveukx/properties/commit/0877cc871db9865f58dd9389ce99e61be05380a5
- https://github.com/steveukx/properties/issues/40
- https://security.snyk.io/vuln/SNYK-JS-PROPERTIESREADER-1048968
- https://github.com/steveukx/properties/commit/0877cc871db9865f58dd9389ce99e61be05380a5
- https://github.com/steveukx/properties/issues/40
- https://security.snyk.io/vuln/SNYK-JS-PROPERTIESREADER-1048968
