PT-2025-5760 · Unknown · Node-Opcua-Alarm-Condition

Published 2025-02-05 · Updated 2025-02-06 · CVE-2024-57086

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions: node-opcua-alarm-condition version 2.134.0

Description: A prototype pollution in the fieldsToJson function allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

Recommendations: For node-opcua-alarm-condition version 2.134.0, consider disabling the fieldsToJson function until a patch is available to prevent potential Denial of Service (DoS) attacks.

Exploit

Fix

DoS

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2024-57086

GHSA-GVWQ-6FMX-28XM

Affected Products

Node-Opcua-Alarm-Condition

References · 8

• 🔥 https://github.com/node-opcua/node-opcua/blob/330db56bb62bce9fff80382daee1fac94311978d/packages/node-opcua-alarm-condition/test/test_cve_polution_attack.ts · Exploit
• 🔥 https://gist.github.com/tariqhawis/30acc3632cf595ca5825b7ec2b2f795a · Exploit
• https://osv.dev/vulnerability/GHSA-gvwq-6fmx-28xm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-57086 · Security Note
• https://github.com/node-opcua/node-opcua · Note
• https://github.com/node-opcua/node-opcua/issues/1433#issuecomment-2791824350 · Note
• https://twitter.com/CVEnew/status/1887254519270052238 · Twitter Post
• https://t.me/cvedetector/17351 · Telegram Post