Critical XSS Vulnerability in DOMPurify: Bypass of Depth Check
Summary
CVE-2024-45801: DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Affects node-dompurify across 3 version ranges.
< 1e520262bf4c66b5efda49e2316d6d1246ca7b21
< 2.4.1+dfsg+~2.4.0-2+deb12u1
< 26e1d69ca7f769f5c558619d644d90dd8bf26ebc
Fixed in 2.4.1+dfsg+~2.4.0-2+deb12u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DOMPurify is a widely-used library designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. It operates solely in the DOM and is known for its speed and tolerance of various input formats. However, recent findings have revealed a critical vulnerability that allows malicious HTML to bypass the depth checking mechanisms implemented in recent versions, making it susceptible to XSS attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2024-45801, arises from the ability of specially crafted malicious HTML to exploit nesting techniques that circumvent the depth checks added to DOMPurify. Additionally, Prototype Pollution can be leveraged to weaken these depth checks, rendering the library ineffective against XSS attacks. This poses significant risks as attackers can inject harmful scripts into web applications, potentially compromising user data and application integrity.
How To Fix
Minimum fixed version
2.4.1+dfsg+~2.4.0-2+deb12u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-dompurifyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are currently no known workarounds for this vulnerability. The only effective solution is to upgrade to the fixed versions of DOMPurify.
Conclusion
The discovery of CVE-2024-45801 highlights a significant security risk in DOMPurify, necessitating immediate action from users to upgrade to the latest versions. Failure to do so could expose applications to XSS attacks, compromising both security and user trust. Regular monitoring and updates are essential to maintain application integrity.
See every vulnerability recorded for node-dompurify →
FAQ
DOMPurify is a fast and tolerant XSS sanitizer for HTML, MathML, and SVG, designed to prevent cross-site scripting attacks.
CVE-2024-45801 refers to a critical vulnerability in DOMPurify that allows malicious HTML to bypass depth checks, leading to potential XSS attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can allow attackers to inject malicious scripts into web applications, compromising user data and application security.
To upgrade DOMPurify, run the command 'npm install dompurify@latest' in your project directory or update the node-dompurify package in your Debian system.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-dompurify.
