CVE-2024-57075
Published: 05 February 2025
Summary
CVE-2024-57075 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 26.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-57075 is a prototype pollution vulnerability in the lib.Logger function of the eazy-logger package version 4.0.1, a JavaScript logging library. This flaw allows attackers to manipulate the prototype chain by supplying a crafted payload, leading to a Denial of Service (DoS) condition. The vulnerability is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-400 (Uncontrolled Resource Consumption).
The vulnerability can be exploited remotely over the network with low complexity, requiring no authentication, privileges, or user interaction. Any unauthenticated attacker who can supply a malicious payload to an application using the affected lib.Logger function can trigger the prototype pollution, resulting in resource exhaustion and application crashes that disrupt availability without impacting confidentiality or integrity.
Details on exploitation, including a proof-of-concept, and potential mitigations are provided in the advisory at https://gist.github.com/tariqhawis/c601f7f85146510ca899a7406a03aba5, published on 2025-02-05.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53518
Vulnerability details
A prototype pollution in the lib.Logger function of eazy-logger v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Prototype pollution triggers uncontrolled resource consumption leading to application crashes, directly enabling T1499.004 Application or System Exploitation for DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Remediating the prototype pollution flaw in eazy-logger v4.0.1 by patching, updating, or replacing the library directly prevents exploitation leading to DoS.
Validating all inputs supplied to the lib.Logger function blocks crafted payloads that trigger prototype pollution and resource exhaustion.
Denial-of-service protections such as rate limiting and resource quotas mitigate the impact of resource exhaustion from prototype pollution exploitation.