cure53/dompurify · Security
DOMPurify allows tampering by prototype pollution
- GHSA ID
- GHSA-mmhx-hmjr-r674
- CVE ID
- CVE-2024-45801
- Severity
- high
- Published
- Updated
- CVSS
- 7 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L
- CVSS v3
- 7 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L
- CVSS v4
- 8.3 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Description
It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to use Prototype Pollution to weaken the depth check.
This renders dompurify unable to avoid XSS attack.
Fixed by https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21 (3.x branch) and https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc (2.x branch).
CWEs
- CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- CWE-1333 · Inefficient Regular Expression Complexity
References
- https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674 ↗
- https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21 ↗
- https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc ↗
- https://nvd.nist.gov/vuln/detail/CVE-2024-45801 ↗
- https://github.com/advisories/GHSA-mmhx-hmjr-r674 ↗