CVE-2024-38988
Published: 28 March 2025
Summary
CVE-2024-38988 is a critical-severity Prototype Pollution (CWE-1321) vulnerability in Alizeait Unflatto. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the prototype pollution vulnerability by requiring timely remediation, such as patching or replacing the vulnerable alizeait unflatto library.
Addresses prototype pollution by enforcing validation and sanitization of inputs to the exports.unflatto method to block arbitrary property injection.
Mitigates the impact of arbitrary code execution from prototype pollution through safeguards protecting system memory from unauthorized code.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The remotely exploitable prototype pollution vulnerability in a library allows unauthenticated attackers to achieve arbitrary code execution or DoS over the network, directly enabling exploitation of public-facing applications.
NVD Description
alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/index.js. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
Deeper analysisAI
CVE-2024-38988 is a prototype pollution vulnerability in alizeait unflatto versions up to and including 1.0.2. The flaw occurs via the exports.unflatto method located at /dist/index.js, enabling attackers to inject arbitrary properties into object prototypes.
With a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability is exploitable over the network by unauthenticated attackers requiring low complexity and no user interaction. Exploitation allows remote attackers to execute arbitrary code or trigger a Denial of Service (DoS) condition, as classified under CWE-1321: Improperly Controlled Modification of Object Prototype Attributes.
Further details are available in the referenced advisory at https://gist.github.com/mestrtee/4c5dfb66bea377889c44dd6c8af28713.
Details
- CWE(s)