Compliance Impact

I don't know

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in DOMPurify versions 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, where attackers can bypass attribute sanitization due to missing rawtext elements in the SAFE_FOR_XML regular expression. Specifically, five rawtext elements (noscript, xmp, noembed, noframes, iframe) were not properly handled, allowing attackers to inject malicious payloads such as </noscript><img src=x onerror=alert(1)> inside attribute values.

When the sanitized output is placed inside these unprotected rawtext contexts, the injected JavaScript can execute, leading to a cross-site scripting (XSS) vulnerability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute arbitrary JavaScript code in the context of a vulnerable web application by injecting malicious scripts through improperly sanitized attributes.

Such cross-site scripting (XSS) attacks can lead to session hijacking, defacement, data theft, or other malicious actions that compromise user security and trust.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves DOMPurify versions 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, where certain rawtext elements are not properly sanitized, allowing cross-site scripting attacks.

To detect if your system is vulnerable, you should first identify if your environment uses one of the affected DOMPurify versions.

You can check the installed DOMPurify version by running commands like:

• npm list dompurify
• yarn list dompurify

Additionally, to detect exploitation attempts on your network, you can monitor for suspicious payloads containing rawtext tags such as </noscript><img src=x onerror=alert(1)> in HTTP requests or logs.

For example, using grep on your web server logs to find such patterns:

• grep -iE '</noscript>|<xmp>|<noembed>|<noframes>|<iframe>' /var/log/nginx/access.log
• grep -i 'onerror=' /var/log/nginx/access.log

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to update DOMPurify to a version that includes the fix for this vulnerability.

The fix involves an improved regular expression that properly sanitizes rawtext elements such as noscript, xmp, noembed, noframes, and iframe, preventing bypass of attribute sanitization.

Specifically, upgrading to a DOMPurify version that includes the commit 729097f or later will address this issue.

If immediate upgrade is not possible, consider implementing additional input validation or output encoding on your application side to prevent injection of malicious payloads in rawtext contexts.

Useful 0 Not Useful 0