CVE-2024-57076
Published: 05 February 2025
Summary
CVE-2024-57076 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 11.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-57076 is a prototype pollution vulnerability in the lib.post function of the ajax-request package version 1.2.3. This issue allows attackers to supply a crafted payload that triggers a Denial of Service (DoS) condition. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is linked to CWE-400 (Uncontrolled Resource Consumption). It was published on 2025-02-05.
Attackers can exploit this vulnerability remotely over the network with low complexity and no authentication or user interaction required. An unauthenticated adversary simply needs to send a specially crafted payload to the lib.post function, achieving a high-impact denial of service that disrupts availability without affecting confidentiality or integrity.
Mitigation details are available in the referenced advisory at https://gist.github.com/tariqhawis/c432b93ee7d967c2e65bc1bf39241664.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-53519
Vulnerability details
A prototype pollution in the lib.post function of ajax-request v1.2.3 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Prototype pollution in ajax-request lib.post directly enables application exploitation leading to DoS (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of inputs to the lib.post function, directly preventing prototype pollution from crafted payloads that cause DoS.
Mandates monitoring, testing, and remediation of flaws like the prototype pollution vulnerability in ajax-request v1.2.3 via patching or upgrades.
Provides denial-of-service protections to mitigate high-impact availability disruption from uncontrolled resource consumption triggered by the vulnerability.