CVE-2024-57075

描述

A prototype pollution in the lib.Logger function of eazy-logger v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. An attacker can supply a payload with `Object.prototype` setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence. Moreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., `child_process.exec`, `eval`), it could enable an attacker to execute arbitrary commands within the application's context. ## Proof of Concept ```js (async () => { const lib = await import('eazy-logger'); var someObj = {} console.log("Before Attack: ", JSON.stringify({}.__proto__)); try { // for multiple functions, uncomment only one for each execution. lib.Logger (JSON.parse('{"__proto__":{"pollutedKey":123}}')) } catch (e) { } console.log("After Attack: ", JSON.stringify({}.__proto__)); delete Object.prototype.pollutedKey; })(); ```

如何修補 CVE-2024-57075

要修補 CVE-2024-57075,請將受影響套件升級到下列已修補版本。

• —升級至 4.1.0 或更新版本

CVE-2024-57075 正在被利用嗎?

低 — EPSS 為 0.1%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 4.1.0

CVSS 分數

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-57075
• PATCHgithub.com/shakyShane/eazy-logger
• WEBgist.github.com/tariqhawis/c601f7f85146510ca899a7406a03aba5
• WEBgithub.com/shakyShane/eazy-logger/commit/a8baa6fe441d19ffa9916eba367016b7937a28fd