Executive brief
eazy-logger is a Node.js logging library used to capture and format application logs. A prototype pollution vulnerability in the Logger function allows attackers to poison the global JavaScript prototype chain by supplying malicious input, causing the application to crash or potentially enabling arbitrary command execution if polluted properties reach sensitive Node.js APIs like child_process.exec.
Technical details
This prototype pollution vulnerability (CWE-1321, CWE-400) exists in the lib.Logger function of eazy-logger versions up to 4.0.1. An attacker can inject a crafted payload containing __proto__ properties that modifies Object.prototype properties. The vulnerability requires network access but no authentication or user interaction—an attacker simply passes a malicious JSON object to the Logger function. While the direct impact is denial of service, the polluted prototype properties could escalate to remote code execution if they propagate to dangerous APIs like child_process.exec or eval. The vendor released version 4.1.0 with a fix as documented in commit a8baa6f.
Affected products
- eazy-logger eazy-logger <=4.0.1
Timeline
- 2025-02-05: disclosed: CVE-2024-57075 published on NVD
- 2025-02-06: advisory: GHSA-r7jx-5m6m-cpg9 published
- 2025-02-06: patched: Fix released in version 4.1.0 via commit a8baa6f