CVE-2020-28472

Q: What is the severity of CVE-2020-28472?

CVE-2020-28472 has a CVSS score of 7.3 (HIGH). This is a prototype pollution vulnerability in AWS SDK JavaScript libraries that allows attackers to modify object prototypes by submitting malicious INI configuration files. Applications using affected versions of @aws-sdk/shared-ini-file-loader or aws-sdk to parse INI files are vulnerable. The impact depends on how the polluted prototypes are used in the application context.

7.3 HIGH

📋 TL;DR

This is a prototype pollution vulnerability in AWS SDK JavaScript libraries that allows attackers to modify object prototypes by submitting malicious INI configuration files. Applications using affected versions of @aws-sdk/shared-ini-file-loader or aws-sdk to parse INI files are vulnerable. The impact depends on how the polluted prototypes are used in the application context.

💻 Affected Systems

Products:

@aws-sdk/shared-ini-file-loader
aws-sdk

Versions: @aws-sdk/shared-ini-file-loader: versions before 1.0.0-rc.9; aws-sdk: versions before 2.814.0

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Applications must use the loadSharedConfigFiles function to parse INI files to be vulnerable. The vulnerability requires attacker-controlled INI files to be processed.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution, data exfiltration, or complete application compromise through prototype pollution leading to arbitrary code execution.

🟠

Likely Case

Application instability, denial of service, or data manipulation through prototype pollution affecting application behavior.

🟢

If Mitigated

Limited impact with proper input validation and file source restrictions, potentially only causing application errors.

🌐 Internet-Facing: MEDIUM

🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires the application to process attacker-submitted INI files. The complexity depends on how the application uses the parsed configuration data.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: @aws-sdk/shared-ini-file-loader: 1.0.0-rc.9 or later; aws-sdk: 2.814.0 or later

Vendor Advisory: https://github.com/aws/aws-sdk-js-v3/commit/a209082dff913939672bb069964b33aa4c5409a9

Restart Required: Yes

Instructions:

1. Update @aws-sdk/shared-ini-file-loader to version 1.0.0-rc.9 or later using npm update @aws-sdk/shared-ini-file-loader. 2. Update aws-sdk to version 2.814.0 or later using npm update aws-sdk. 3. Restart all affected applications and services.

🔧 Temporary Workarounds

Input validation for INI files

all

Implement strict validation of INI file sources and content before processing with loadSharedConfigFiles

Disable INI file loading

all

Configure applications to not use INI configuration files if not required

🧯 If You Can't Patch

Implement strict access controls on INI file upload/input sources
Use application-level sandboxing or isolation for INI file parsing processes

🔍 How to Verify

Check if Vulnerable:

Check package.json for @aws-sdk/shared-ini-file-loader version <1.0.0-rc.9 or aws-sdk version <2.814.0

Check Version:

npm list @aws-sdk/shared-ini-file-loader && npm list aws-sdk

Verify Fix Applied:

Verify package.json shows @aws-sdk/shared-ini-file-loader >=1.0.0-rc.9 or aws-sdk >=2.814.0

📡 Detection & Monitoring

Log Indicators:

Unexpected application crashes or errors when processing INI files
Unusual file upload activity to INI parsing endpoints

Network Indicators:

HTTP requests with INI file uploads to vulnerable endpoints

SIEM Query:

source="application_logs" AND ("loadSharedConfigFiles" OR "INI parsing") AND (error OR crash)

📊 Metadata

CVE ID: CVE-2020-28472

CVSS v3 Score: 7.3 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Published: January 19, 2021

Last Updated: November 21, 2024

🔗 References

https://github.com/aws/aws-sdk-js-v3/commit/a209082dff913939672bb069964b33aa4c5409a9 Patch,Third Party Advisory
https://github.com/aws/aws-sdk-js/pull/3585/commits/7d72aff2a941173733fcb6741b104cd83d3bc611 Patch,Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1059426 Exploit,Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1059425 Exploit,Third Party Advisory
https://snyk.io/vuln/SNYK-JS-AWSSDK-1059424 Exploit,Third Party Advisory
https://snyk.io/vuln/SNYK-JS-AWSSDKSHAREDINIFILELOADER-1049304 Exploit,Third Party Advisory
https://github.com/aws/aws-sdk-js-v3/commit/a209082dff913939672bb069964b33aa4c5409a9 Patch,Third Party Advisory
https://github.com/aws/aws-sdk-js/pull/3585/commits/7d72aff2a941173733fcb6741b104cd83d3bc611 Patch,Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1059426 Exploit,Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1059425 Exploit,Third Party Advisory
https://snyk.io/vuln/SNYK-JS-AWSSDK-1059424 Exploit,Third Party Advisory
https://snyk.io/vuln/SNYK-JS-AWSSDKSHAREDINIFILELOADER-1049304 Exploit,Third Party Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Aws Sdk For Javascipt by Amazon

Aws Shared Configuration File Loader by Amazon

Aws Shared Configuration File Loader by Amazon

Aws Shared Configuration File Loader by Amazon

Aws Shared Configuration File Loader by Amazon

Aws Shared Configuration File Loader by Amazon

Aws Shared Configuration File Loader by Amazon

Aws Shared Configuration File Loader by Amazon

Aws Shared Configuration File Loader by Amazon

Aws Shared Configuration File Loader by Amazon

Aws Shared Configuration File Loader by Amazon

Aws Shared Configuration File Loader by Amazon

Aws Shared Configuration File Loader by Amazon

Aws Shared Configuration File Loader by Amazon

Aws Shared Configuration File Loader by Amazon

Aws Shared Configuration File Loader by Amazon

Aws Shared Configuration File Loader by Amazon

Aws Shared Configuration File Loader by Amazon

Aws Shared Configuration File Loader by Amazon

Aws Shared Configuration File Loader by Amazon

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Input validation for INI files

Disable INI file loading

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export