CVE-2024-57063
📋 TL;DR
This vulnerability is a prototype pollution flaw in php-date-formatter v1.3.6 that allows attackers to inject malicious properties into JavaScript objects. By supplying a crafted payload, attackers can cause Denial of Service (DoS) by crashing the application. Any application using the vulnerable version of php-date-formatter is affected.
💻 Affected Systems
- php-date-formatter
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete application crash leading to sustained downtime, potential data corruption, and service unavailability until manual intervention.
Likely Case
Application instability and intermittent crashes causing degraded performance and partial service disruption.
If Mitigated
Minimal impact with proper input validation and security controls in place, potentially causing only minor performance degradation.
🎯 Exploit Status
Exploitation requires understanding of prototype pollution techniques and ability to craft specific payloads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.3.7 or later
Vendor Advisory: https://gist.github.com/tariqhawis/dcb93b4788273c3ffb15f70dc45ca4e7
Restart Required: No
Instructions:
1. Update php-date-formatter to v1.3.7 or later using npm: npm update php-date-formatter
2. Verify the update completed successfully
3. Test application functionality to ensure compatibility
🔧 Temporary Workarounds
Input Validation Sanitization
allImplement strict input validation to reject malformed date format strings before they reach the vulnerable function.
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block suspicious date format patterns
- Isolate affected systems from untrusted networks and implement strict access controls
🔍 How to Verify
Check if Vulnerable:
Check package.json or run: npm list php-date-formatterCheck Version:
npm list php-date-formatter | grep php-date-formatterVerify Fix Applied:
Verify installed version is v1.3.7 or later: npm list php-date-formatter | grep php-date-formatter📡 Detection & Monitoring
Log Indicators:
- Application crash logs
- Unusual memory usage spikes
- Error messages related to date formatting
Network Indicators:
- Unusual patterns in date format parameters
- Repeated requests with malformed date strings
SIEM Query:
source=application_logs AND ("php-date-formatter" OR "date formatting error" OR "prototype pollution")