CVE-2024-57086
Published: 05 February 2025
Summary
CVE-2024-57086 is a high-severity Prototype Pollution (CWE-1321) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 40.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires identification, reporting, and timely remediation of flaws such as the prototype pollution vulnerability in node-opcua-alarm-condition v2.134.0.
Mandates validation of information inputs to block crafted payloads that exploit the fieldsToJson function for prototype pollution.
Provides protection against and detection of DoS events resulting from successful prototype pollution exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Prototype pollution in exposed Node.js function directly enables remote unauthenticated exploitation leading to application DoS (high availability impact, no other CIA effects).
NVD Description
A prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
Deeper analysisAI
CVE-2024-57086 is a prototype pollution vulnerability in the fieldsToJson function of the node-opcua-alarm-condition package version 2.134.0. This flaw allows attackers to cause a Denial of Service (DoS) condition by supplying a crafted payload. The vulnerability is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')).
Remote attackers without privileges can exploit this vulnerability over the network with low attack complexity and no user interaction required. Successful exploitation leads to high-impact disruption of availability for affected applications using the vulnerable package, while confidentiality and integrity remain unaffected.
Advisories and additional details, including potential proof-of-concept information, are available at the referenced GitHub Gist: https://gist.github.com/tariqhawis/30acc3632cf595ca5825b7ec2b2f795a.
Details
- CWE(s)