DOM Clobbering Vulnerability in Webpack: XSS Risk in Node-Webpack Packages
Summary
UBUNTU-CVE-2024-43788: Webpack is a module bundler. Affects node-webpack versions 3.5.6-1build3 – 3.5.6-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Webpack is a powerful module bundler primarily used for bundling JavaScript files for web applications. It can also transform and package various resources and assets. The affected package, node-webpack, is a Debian package that integrates Webpack into the Ubuntu ecosystem. This vulnerability exposes applications using Webpack to potential cross-site scripting (XSS) attacks due to improper handling of HTML elements.
Vulnerability Detail
The vulnerability arises from a DOM Clobbering issue in Webpack's AutoPublicPathRuntimeModule. This flaw allows an attacker to exploit scriptless HTML elements, such as an img tag with an unsanitized name attribute, to execute XSS attacks. Real-world exploitation has been observed in applications like Canvas LMS, where attackers can inject malicious code through Webpack-generated files. The vulnerability is classified with a CVSS score of 6.4, indicating a medium severity risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability. The best course of action is to upgrade to the patched version as soon as possible.
Conclusion
The DOM Clobbering vulnerability in Webpack poses a significant risk of XSS attacks in applications using the affected node-webpack packages. Users are strongly advised to upgrade to the patched version to protect their applications from potential exploitation.
See every vulnerability recorded for node-webpack →
FAQ
The vulnerability is a DOM Clobbering issue that can lead to cross-site scripting (XSS) attacks in applications using Webpack.
The affected versions include node-webpack 3.5.6-2, 4.30.0-9, 4.43.0-7, 5.76.1+dfsg1+~cs17.16.16-1, and 5.97.1+dfsg1+~cs11.18.27-2.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
While there are no workarounds, it is crucial to prioritize the upgrade to the patched version to mitigate the risk of exploitation.
The CVSS score for this vulnerability is 6.4, indicating a medium severity risk.
Related vulnerabilities
Recent vulnerabilities recorded for node-webpack.
