CVE-2024-38988
Published: 28 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2024-38988 is a prototype pollution vulnerability in alizeait unflatto versions up to and including 1.0.2. The flaw occurs via the exports.unflatto method located at /dist/index.js, enabling attackers to inject arbitrary properties into object prototypes.
With a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability is exploitable over the network by unauthenticated attackers requiring low complexity and no user interaction. Exploitation allows remote attackers to execute arbitrary code or trigger a Denial of Service (DoS) condition, as classified under CWE-1321: Improperly Controlled Modification of Object Prototype Attributes.
Further details are available in the referenced advisory at https://gist.github.com/mestrtee/4c5dfb66bea377889c44dd6c8af28713.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The remotely exploitable prototype pollution vulnerability in a library allows unauthenticated attackers to achieve arbitrary code execution or DoS over the network, directly enabling exploitation of public-facing applications.