Critical Vulnerability in DOMPurify Package: Nesting-based mXSS Exposure
Summary
UBUNTU-CVE-2024-47875: DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. Affects node-dompurify versions 2.3.0+dfsg-2 – 2.3.3+dfsg-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DOMPurify is a widely-used library designed for sanitizing HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. It is known for its speed and tolerance, making it a popular choice among developers for ensuring web application security. However, recent findings have revealed that certain versions of DOMPurify are vulnerable to nesting-based mXSS attacks, which can allow malicious scripts to execute in the context of a user's browser.
Vulnerability Detail
The vulnerability identified as CVE-2024-47875 affects multiple versions of the DOMPurify package. It originates from improper handling of nested elements, which can lead to the execution of malicious scripts when untrusted content is processed. This vulnerability poses significant risks, as it can compromise user data, session integrity, and overall application security. The affected versions include node-dompurify versions prior to 2.5.0 and 3.1.3, with a CVSS score of 10.0 indicating critical severity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can implement additional input validation and sanitization measures to mitigate the risk of XSS attacks. This may include using alternative libraries or manually sanitizing user inputs before processing them with DOMPurify.
Conclusion
The vulnerability CVE-2024-47875 in the DOMPurify package presents a critical risk due to its potential to allow nesting-based mXSS attacks. It is crucial for developers to update to the patched versions to safeguard their applications. Utilizing tools like Vulert can help in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for node-dompurify →
FAQ
DOMPurify is a fast and tolerant XSS sanitizer for HTML, MathML, and SVG, designed to protect web applications from cross-site scripting attacks.
CVE-2024-47875 is the identifier for a critical vulnerability in specific versions of the DOMPurify package that allows nesting-based mXSS attacks.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
If exploited, this vulnerability can lead to unauthorized script execution, compromising user data and session integrity, and potentially allowing attackers to take control of user sessions.
You can update the DOMPurify package by running the command 'sudo apt-get install node-dompurify=<patched_version>' in your terminal, replacing <patched_version> with the latest secure version.
Related vulnerabilities
Recent vulnerabilities recorded for node-dompurify.
