CVE-2024-57084
Published: 05 February 2025
Summary
CVE-2024-57084 is a high-severity Prototype Pollution (CWE-1321) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 40.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of inputs to the lib.parse function to block crafted payloads that trigger prototype pollution and DoS.
Mandates identification, reporting, and correction of flaws like the prototype pollution vulnerability in dot-properties v1.0.1 to eliminate the DoS risk.
Limits the effects of DoS attacks, including those from prototype pollution causing application crashes or resource exhaustion.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Prototype pollution input directly triggers application crash or resource exhaustion DoS via remote exploitation of the parsing function.
NVD Description
A prototype pollution in the function lib.parse of dot-properties v1.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
Deeper analysisAI
CVE-2024-57084 is a prototype pollution vulnerability in the lib.parse function of the dot-properties package version 1.0.1. This issue allows attackers to supply a crafted payload that triggers a Denial of Service (DoS) condition. The vulnerability is associated with CWE-1321 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting its potential for significant availability disruption.
Remote attackers can exploit this vulnerability over the network without authentication or user interaction, requiring only low complexity. By providing a specially crafted input to the affected parsing function, they can pollute the JavaScript prototype chain, leading to application crashes or excessive resource consumption that denies service to legitimate users.
Advisories and further details are available in the referenced GitHub Gist at https://gist.github.com/tariqhawis/3dbeb208c3e22f90a601818ccd06a948.
Details
- CWE(s)