CVE-2024-57063
Published: 05 February 2025
Summary
CVE-2024-57063 is a high-severity Prototype Pollution (CWE-1321) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 42.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the prototype pollution flaw in php-date-formatter v1.3.6 to eliminate the DoS vulnerability.
Implements denial-of-service protections that limit the impact of remote exploitation causing high availability disruption.
Validates inputs to block crafted payloads targeting the vulnerable lib function and preventing prototype pollution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Prototype pollution enables remote crafted-payload DoS via application exploitation, directly mapping to T1499.004.
NVD Description
A prototype pollution in the lib function of php-date-formatter v1.3.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
Deeper analysisAI
CVE-2024-57063 is a prototype pollution vulnerability in the lib function of the php-date-formatter library version 1.3.6. This issue enables attackers to cause a Denial of Service (DoS) condition by supplying a crafted payload. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is classified under CWE-1321.
Remote attackers can exploit this vulnerability over the network without authentication, privileges, or user interaction, using low-complexity techniques. Successful exploitation results in high-impact disruption to availability, leading to a DoS, with no effects on confidentiality or integrity.
Mitigation details are available in the referenced advisory at https://gist.github.com/tariqhawis/dcb93b4788273c3ffb15f70dc45ca4e7.
Details
- CWE(s)