CVE-2024-57076
Published: 05 February 2025
Description
A prototype pollution in the lib.post function of ajax-request v1.2.3 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
Security Summary
CVE-2024-57076 is a prototype pollution vulnerability in the lib.post function of the ajax-request package version 1.2.3. This issue allows attackers to supply a crafted payload that triggers a Denial of Service (DoS) condition. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is linked to CWE-400 (Uncontrolled Resource Consumption). It was published on 2025-02-05.
Attackers can exploit this vulnerability remotely over the network with low complexity and no authentication or user interaction required. An unauthenticated adversary simply needs to send a specially crafted payload to the lib.post function, achieving a high-impact denial of service that disrupts availability without affecting confidentiality or integrity.
Mitigation details are available in the referenced advisory at https://gist.github.com/tariqhawis/c432b93ee7d967c2e65bc1bf39241664.
Details
- CWE(s)