CVE-2024-57071
Published: 05 February 2025
Summary
CVE-2024-57071 is a high-severity Prototype Pollution (CWE-1321) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 40.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of the prototype pollution flaw in php-parser v3.2.1 through patching or replacement to prevent DoS exploitation.
Validates crafted payloads supplied to the lib.combine function to block prototype pollution attacks.
Implements protections against resource exhaustion DoS resulting from prototype pollution in php-parser.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Prototype pollution enables direct application-layer DoS via crafted input over the network (resource exhaustion/crash).
NVD Description
A prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
Deeper analysisAI
CVE-2024-57071 is a prototype pollution vulnerability in the lib.combine function of php-parser version 3.2.1. This flaw allows attackers to supply a crafted payload that pollutes the JavaScript prototype chain, leading to a Denial of Service (DoS) condition. The vulnerability is classified under CWE-1321 (Prototype Pollution) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to its impact on availability.
The attack requires no authentication or user interaction, making it exploitable by unauthenticated attackers over the network with low complexity. By sending a specially crafted payload to an application using the vulnerable php-parser v3.2.1 library, attackers can trigger the prototype pollution in lib.combine, resulting in resource exhaustion or application crashes that disrupt service availability without affecting confidentiality or integrity.
Advisories reference a GitHub Gist at https://gist.github.com/tariqhawis/b56500d3a8866467ee769df7453eedaa, which likely contains proof-of-concept details for the vulnerability, though specific patch or mitigation guidance is not detailed in available information.
Details
- CWE(s)