CVE-2024-57708
MEDIUMOneTrust SDK 6.33.0 - Denial of Service via Prototype Pollution
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-57708. PoCs published by Alameen Karim Merali.
AI-analyzed exploit summary The exploit demonstrates a Prototype Pollution vulnerability in OneTrust SDK 6.33.0, allowing an attacker to inject malicious properties into the prototype chain, leading to Denial of Service (DoS) or altered object behavior. The PoC uses `Object.setPrototypeOf` and `Object.assign` to pollute `Object.prototype` globally.
Description
An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __proto__, and Object.assign components. NOTE: this is disputed by the Supplier who does not agree it is a prototype pollution vulnerability.
Exploits (1)
The exploit demonstrates a Prototype Pollution vulnerability in OneTrust SDK 6.33.0, allowing an attacker to inject malicious properties into the prototype chain, leading to Denial of Service (DoS) or altered object behavior. The PoC uses `Object.setPrototypeOf` and `Object.assign` to pollute `Object.prototype` globally.
References (3)
Scores
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H