CVE-2024-38985
Published: 28 March 2025
Summary
CVE-2024-38985 is a critical-severity Prototype Pollution (CWE-1321) vulnerability in Janrywang Depath. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 40.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and correction of the prototype pollution flaw in depath v1.0.6 and cool-path v1.1.2, directly preventing arbitrary code execution and DoS exploitation.
Vulnerability monitoring and scanning identifies the presence of CVE-2024-38985 in deployed software components like depath and cool-path.
Validates inputs to the vulnerable setIn method to block injection of arbitrary properties that enable prototype pollution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated RCE via prototype pollution in exposed JS library directly enables T1190 (public-facing app exploitation) and T1059.007 (JavaScript command execution).
NVD Description
janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/index.js:90). This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
Deeper analysisAI
CVE-2024-38985 is a prototype pollution vulnerability affecting janryWang products depath v1.0.6 and cool-path v1.1.2. The flaw occurs via the set() method at setIn (lib/index.js:90), enabling attackers to inject arbitrary properties into prototypes. Published on 2025-03-28, it has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-1321.
Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation allows arbitrary code execution or denial of service (DoS) by injecting malicious properties that pollute object prototypes.
Advisories and related resources include a GitHub issue for depath at https://github.com/janryWang/depath/issues/11 and a proof-of-concept gist at https://gist.github.com/mestrtee/32c0a48023036e51918f6a098f21953d.
Details
- CWE(s)