Critical XSS Vulnerability in node-dompurify: Nesting-based mXSS Exploit
Summary
CVE-2024-47875: DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Affects cacti across 3 version ranges.
< 0ef5e537a514f904b6aa1d7ad9e749e365d7185f
< 1.2.16+ds1-2+deb11u5
< 6ea80cd8b47640c20f2f230c7920b1f4ce4fdf7a
Fixed in 1.2.16+ds1-2+deb11u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DOMPurify is a widely used library designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. It is known for its speed and tolerance, making it a popular choice among developers for ensuring web application security. However, a recent vulnerability has been identified in the node-dompurify package, which is the Node.js implementation of DOMPurify, affecting versions prior to 2.5.0 and 3.1.3.
Vulnerability Detail
The vulnerability, identified as CVE-2024-47875, is a nesting-based mXSS (malicious cross-site scripting) issue. It arises from improper handling of nested elements, allowing attackers to inject malicious scripts that can execute in the context of the user's browser. This can lead to unauthorized access to sensitive information, session hijacking, and other malicious activities. The vulnerability affects both Debian 12 and 13 ecosystems and has been fixed in the specified versions.
How To Fix
Minimum fixed version
1.2.16+ds1-2+deb11u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade cactiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional input validation and sanitization on user inputs before passing them to DOMPurify. However, this is not a substitute for updating to the patched version of the library.
Conclusion
The CVE-2024-47875 vulnerability in node-dompurify poses significant risks due to its potential for mXSS attacks. It is crucial for developers using this package to update to the latest patched versions to safeguard their applications from exploitation. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for cacti →
FAQ
CVE-2024-47875 is a critical vulnerability in the node-dompurify package that allows for nesting-based mXSS attacks, potentially compromising user data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access to sensitive information, session hijacking, and execution of malicious scripts in the user's browser.
Yes, the vulnerability has been fixed in versions 2.5.0 and 3.1.3 of the node-dompurify package.
If immediate updates are not possible, implement additional input validation and sanitization as a temporary workaround until you can upgrade.
References
Related vulnerabilities
Recent vulnerabilities recorded for cacti.
