CVE-2024-57065
Published: 05 February 2025
Summary
CVE-2024-57065 is a high-severity Prototype Pollution (CWE-1321) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 11.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SC-5 (Denial-of-service Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Remediating flaws in vulnerable libraries like utile v0.3.0 directly prevents prototype pollution exploitation leading to DoS.
Implements protections against denial-of-service attacks, limiting the availability impact from prototype pollution in the lib.createPath function.
Validates untrusted inputs to the lib.createPath function, preventing crafted payloads from polluting the object prototype chain.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Prototype pollution in lib.createPath directly enables remote exploitation for Endpoint DoS via application/system exploitation (T1499.004).
NVD Description
A prototype pollution in the lib.createPath function of utile v0.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
Deeper analysisAI
CVE-2024-57065 is a prototype pollution vulnerability in the lib.createPath function of the utile v0.3.0 JavaScript library. This flaw allows attackers to supply a crafted payload that pollutes the prototype chain, leading to a Denial of Service (DoS) condition. The vulnerability is classified under CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) and has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its impact on availability.
The vulnerability can be exploited by any remote, unauthenticated attacker with network access to an application using the affected utile v0.3.0 library. Exploitation requires low complexity and no user interaction, enabling an attacker to send a specially crafted payload to the lib.createPath function. Successful exploitation results in a DoS, disrupting service availability without affecting confidentiality or integrity.
For mitigation details, refer to the advisory at https://gist.github.com/tariqhawis/7b2c50ccdec39a030091e48a4ccde688, published on 2025-02-05.
Details
- CWE(s)