CVE-2024-57078
Published: 05 February 2025
Summary
CVE-2024-57078 is a high-severity Prototype Pollution (CWE-1321) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 40.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SC-5 (Denial-of-service Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 mandates timely identification, reporting, and remediation of flaws like the prototype pollution vulnerability in cli-util v1.1.27 to prevent DoS exploitation.
SI-10 requires validation of untrusted inputs to block crafted payloads that exploit the lib.merge function's prototype pollution leading to DoS.
SC-5 implements protections to limit the effects of DoS events, including application crashes from prototype pollution attacks.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Prototype pollution leads directly to application DoS via crafted input exploitation (T1499.004).
NVD Description
A prototype pollution in the lib.merge function of cli-util v1.1.27 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
Deeper analysisAI
CVE-2024-57078 is a prototype pollution vulnerability in the lib.merge function of cli-util version 1.1.27. This flaw allows attackers to supply a crafted payload that pollutes the JavaScript prototype chain, leading to a Denial of Service (DoS) condition. The vulnerability is classified under CWE-1321 and has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity due to its potential for significant availability impact without requiring authentication or user interaction.
The attack scenario involves remote attackers who can exploit this vulnerability over the network with low complexity. No privileges or user interaction are needed, enabling unauthenticated attackers to send a specially crafted payload to applications using the affected cli-util library. Successful exploitation results in a DoS, disrupting service availability by crashing or hanging the targeted application.
Advisories and additional details are provided in the reference at https://gist.github.com/tariqhawis/b58d7274d67e7b9fed4bd51368388a23, which likely includes proof-of-concept information or further technical analysis relevant to mitigation strategies.
Details
- CWE(s)