CVE-2024-57066
Published: 05 February 2025
Summary
CVE-2024-57066 is a high-severity Prototype Pollution (CWE-1321) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and correction of flaws like the prototype pollution in @ndhoule/defaults v2.0.1 to prevent DoS exploitation.
Mandates vulnerability scanning and monitoring to identify the presence of CVE-2024-57066 in npm package dependencies.
Validates information inputs to block crafted payloads that trigger prototype pollution in the lib.deep function.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Prototype pollution in public-facing npm package directly enables remote exploitation (T1190) leading to application DoS via crafted input (T1499.004).
NVD Description
A prototype pollution in the lib.deep function of @ndhoule/defaults v2.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
Deeper analysisAI
CVE-2024-57066 is a prototype pollution vulnerability in the lib.deep function of the @ndhoule/defaults npm package version 2.0.1. This flaw allows attackers to manipulate object prototypes by supplying a crafted payload, leading to a Denial of Service (DoS) condition. The vulnerability is classified under CWE-1321 (Prototype Pollution) with a CVSS v3.1 base score of 7.5, reflecting high severity due to its impact on availability.
Remote attackers can exploit this vulnerability over the network with low complexity, requiring no privileges, authentication, or user interaction (AV:N/AC:L/PR:N/UI:N). By injecting a malicious payload into the lib.deep function, an attacker can pollute the prototype chain, potentially crashing the application or rendering it unresponsive, resulting in high availability impact (A:H) without affecting confidentiality or integrity.
Advisories point to a GitHub Gist for further details on the vulnerability: https://gist.github.com/tariqhawis/8ee7327cc8b78df738cd32505cbbbd44. No specific patches or mitigations are detailed in the provided CVE information.
Details
- CWE(s)